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4800  MARK  CENTER  DRIVE 
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April  26,  2013 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  INFORMATION  SYSTEMS 

AGENCY 

CHIEF  FINANCIAL  EXECUTIVE,  DEFENSE 
INFORMATION  SYSTEMS  AGENCY 
MANAGING  PARTNER,  ACUITY  CONSULTING 

SUBJECT:  The  Audit  Opinion  of  the  DISA  FY  201 1  Working  Capital  Fund  Financial 
Statements  Was  Not  Adequately  Supported 
(Report  No.  DODIG-20 13-071) 

We  are  providing  this  report  for  review  and  comment.  Acuity’s  auditing  procedures  on 
the  DISA  FY  201 1  Working  Capital  Fund  Financial  Statements  were  inadequate.  In 
addition,  the  Director,  Procurement  and  Logistics  Directorate  prohibited  the  COR  from 
completing  key  duties  required  to  provide  oversight  of  Acuity’s  work.  As  a  result, 

Acuity  did  not  have  sufficient  evidence  to  issue  an  unqualified  opinion  on  the  DISA  FY 
201 1  Working  Capital  Fund  Financial  Statements. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  DoD  Directive  7650.3  requires  that  recommendations  be  resolved 
promptly.  Comments  from  the  Vice  Director,  DISA  were  generally  responsive;  however, 
comments  on  Recommendation  l.a  and  Recommendation  l.c  were  only  partially 
responsive.  The  Managing  Partner,  Acuity  also  provided  comments  that  were  generally 
responsive;  however,  comments  on  Recommendation  2.b  were  nonresponsive. 

Therefore,  we  request  additional  comments  on  these  recommendations  by  May  28,  2013. 

If  possible,  send  a  .pdf  file  containing  your  comments  to  audfmr@dodiiz.mil.  Copies  of 
your  comments  must  have  the  actual  signature  of  the  authorizing  official  for  your 
organization.  We  are  unable  to  accept  the  /Signed/  symbol  in  place  of  the  actual 
signature.  If  you  arrange  to  send  classified  comments  electronically,  you  must  send  them 
over  the  SECRET  Internet  Protocol  Router  Network  (SIPRNET). 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  604-8938  (DSN  664-8938). 


(V  ^ 

Richard  B.  Vasquez,  CPA 
Acting  Assistant  Inspector  General 
Financial  Management  and  Reporting 
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Results  in  Brief:  The  Audit  Opinion  of  the 
DISA  FY  2011  Working  Capital  Fund  Financial 
Statements  Was  Not  Adequately  Supported 


What  We  Did 

We  determined  the  adequacy  of  Acuity 
Consulting’s  (Acuity)  auditing  procedures  for 
the  Defense  Information  Systems  Agency 
(DISA)  FY  2011  Working  Capital  Fund  (WCF) 
Financial  Statements.  We  also  determined 
whether  the  contract  oversight  was  sufficient. 

What  We  Found 

Acuity’s  auditing  procedures  on  the  DISA 
FY  2011  WCF  Financial  Statements  were 
inadequate.  Specifically,  Acuity  did  not: 

•  properly  test  the  DISA  Fund  Balance 
with  Treasury  (FBWT)  reconciliations, 

•  determine  whether  the  undistributed 
accounts  were  free  of  material 
misstatements, 

•  adequately  assess  whether  the 
deficiencies  identified  by  DISA  in  its 
FBWT  memorandums  for  record  would 
have  a  material  impact  on  the  financial 
statements  and  Acuity’s  opinion, 

•  perform  adequate  testing  on  Property, 
Plant,  and  Equipment,  and 

•  state  in  its  auditor’s  report  that  the  DISA 
financial  statement  disclosures  were 
inadequate. 

This  occurred  because  Acuity  did  not  perform 
the  audit  in  accordance  with  GAGAS,  the  FAM, 
and  the  AICPA  standards.  In  addition,  the 
contract  oversight  was  not  sufficient  because  the 
Director,  Procurement  and  Logistics  Directorate 
(PLD)  prohibited  the  contracting  officer’s 
representative  (COR)  from  completing  key 
duties  required  to  provide  oversight  of  Acuity’s 
work. 


As  a  result,  Acuity  did  not  have  sufficient 
evidence  to  issue  an  unqualified  opinion  on 
DISA’s  FY  2011  WCF  Financial  Statements. 
Furthermore,  the  DoD  does  not  have  assurance 
that  the  DISA  FY  201 1  WCF  Financial 
Statements  are  free  of  material  misstatements. 

What  We  Recommend 

The  Director,  DISA  should  review  the  actions  of 
the  Director,  PLD;  ensure  that  individuals 
performing  contract  oversight  of  financial 
statement  audits  are  qualified  DISA  employees; 
and  seek  a  refund  from  Acuity. 

The  Managing  Partner,  Acuity  should  withdraw 
their  opinion  and  review  the  planned  work  on 
future  audits  to  gather  sufficient  evidence  to 
support  their  opinion. 

Management  Comments  and 
Our  Response 

The  Vice  Director,  DISA,  responded  for  the 
Director,  stating  agreement  with  the 
recommendations  to  review  the  actions  of  the 
Director,  PLD  and  ensure  that  the  individuals 
performing  contract  oversight  of  financial 
statement  audits  are  qualified  DISA  employees. 
We  request  additional  comments  from  the 
Director,  DISA  on  Recommendations  la  and  lc. 

The  Managing  Partner,  Acuity  responded  stating 
disagreement  with  the  recommendation  to 
withdraw  their  unqualified  opinion.  We  request 
reconsideration  from  the  Managing  Partner, 
Acuity  on  Recommendation  2a.  We  request 
additional  comments  from  the  Managing 
Partner,  Acuity  on  Recommendation  2b.  Please 
see  the  recommendation  table  on  the  back  of 
this  page. 
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Recommendations  Table 


Management 

Recommendations 
Requiring  Comment 

No  Additional  Comments 
Required 

Director,  DISA 

l.a,  l.c 

l.b 

Managing  Partner,  Acuity 

2.b 

2. a 

Please  provide  comments  by  May  28,  2013. 
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Introduction 

Objectives 

The  objective  was  to  determine  the  adequacy  of  the  Independent  Public  Accountant’s 
auditing  procedures  for  the  Defense  Infonnation  Systems  Agency  (DISA)  FY  2011 
Working  Capital  Fund  (WCF)  Financial  Statements.  We  also  determined  whether  the 
contract  oversight  performed  was  sufficient. 

Post  Audit  Review  Background 

On  June  13,  2006,  the  DoD  Office  of  Inspector  General  (OIG)  issued  a  policy 
memorandum  instructing  all  Other  Defense  Organizations  to  execute  contracts  with 
independent  public  accounting  firms  for  the  audit  of  financial  statements  through  the 
Inspector’s  General  Chief  Financial  Officer  Multiple  Award  Contract.  The  purpose  of 
the  policy  was  to  ensure  that  the  DoD  OIG  would  maintain  oversight  of  the  financial 
statement  audits  of  Other  Defense  Organizations.  In  addition,  the  memorandum  states 
that  ongoing  monitoring  would  enable  the  DoD  OIG  to  detennine  whether  it  could  rely 
upon  the  Independent  Public  Accountants’  work  for  the  OIG  to  express  an  opinion  on  the 
Agency-Wide  financial  statements.  On  July  20,  2010,  the  DoD  OIG  issued  a  policy 
memorandum  related  to  the  DoD  OIG  oversight  of  the  financial  statement  audits  for  the 
DoD.  This  memorandum  established  that  the  DoD  OIG  will  conduct  post  audit  reviews 
on  a  sample  of  the  DoD  entities  financial  statement  audits  for  which  we  do  not  provide 
oversight. 

DISA  awarded  a  sole  source  contract  to  Acuity  Consulting  (Acuity)  on  September  30, 
2010  to  detennine  if  the  DISA  FY  2011  WCF  Balance  Sheet,  Statement  of  Net  Cost, 
Statement  of  Changes  in  Net  Position,  and  Statement  of  Budgetary  Resources  present 
fairly  in  all  material  respects  and  confonnity  with  the  accounting  principles  generally 
accepted  in  the  United  States  of  America.  The  contract  required  Acuity  to  conduct  the 
audit  in  accordance  with  Generally  Accepted  Accounting  Principles  and  standards 
applicable  to  financial  audits  contained  in  the  Generally  Accepted  Government  Auditing 
Standards  (GAGAS)  issued  by  the  Comptroller  General  of  the  United  States.  Although 
DISA  is  a  not  an  Office  of  Management  and  Budget  reporting  entity,  in  201 1,  DISA 
chose  to  pursue  an  audit  of  its  financial  statements  as  a  means  to  ensure  the  adequacy  of 
its  controls,  processes,  and  to  evaluate  the  accuracy  of  its  financial  reporting,  as  directed 
by  the  Under  Secretary  of  Defense,  Comptroller. 

Defense  Information  Systems  Agency  Mission 

DISA  is  a  combat  support  agency  comprised  of  16,000  people,  including  military, 
civilian,  and  contractor  partners.  The  DISA  WCF  reporting  entity  is  comprised  of  two 
revolving  funds  which  support  the  Computing  Services  Directorate  (CSD)  and  the 
Telecommunications  Services  and  Enterprise  Acquisition  Services  (TSEAS)  Directorate. 
The  CSD  provides  computing  services  to  DoD,  and  TSEAS  provides  communication 
services  and  contracting  services  to  customers  within  DoD  and  across  the  federal 
government.  DISA  facilitates  the  use  of  real-time  intelligence,  surveillance,  and 
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reconnaissance  information  to  enable  infonnation  exchange  between  the  producer  and  the 
shooter.  DISA  works  with  its  mission  partners  to  provide  technology  and  seamless 
exchange  of  information  so  that  anyone  who  can  connect  to  the  network  can  provide  and 
consume  data  and  services  anywhere  on  the  network  globally. 

DISA  provides  command  and  control  capabilities  and  enterprise  infrastructure  to 
continuously  operate  and  assure  a  global  net-centric  enterprise  in  direct  support  to  joint 
warfighters,  national  level  leaders,  and  other  mission  and  coalition  partners  across  the  full 
spectrum  of  operations. 

Financial  Statement  Assertions 

Financial  statement  assertions  are  management  representations  that  are  embodied  in 
financial  statement  components.  Most  of  the  auditor's  work  in  fonning  an  opinion  on 
financial  statements  consists  of  obtaining  and  evaluating  sufficient  appropriate  evidence 
concerning  the  assertions  in  the  financial  statements.  The  assertions  can  be  explicit  or 
implicit.  The  FAM1  section  235  classifies  assertions  into  the  following  five  broad 
categories: 

•  Existence  or  occurrence — recorded  transactions  and  events  occurred  during  the 
given  period,  are  properly  classified,  and  pertain  to  the  entity.  An  entity’s  assets, 
liabilities,  and  net  position  exist  at  a  given  date. 

•  Completeness — all  transactions  and  events  that  should  have  been  recorded  are 
recorded  in  the  proper  period.  All  assets,  liabilities,  and  net  position  that  should 
have  been  recorded  have  been  recorded  in  the  proper  period  and  properly  included 
in  the  financial  statements. 

•  Rights  and  obligations — the  entity  holds  or  controls  the  rights  to  assets,  and 
liabilities  are  the  obligations  of  the  entity  at  a  given  date. 

•  Accuracy/valuation  or  allocation — amounts  and  other  data  relating  to  recorded 
transactions  and  events  have  been  recorded  appropriately.  Assets,  liabilities,  and 
net  position  are  included  in  the  financial  statements  at  appropriate  amounts,  and 
any  resulting  valuation  or  allocation  adjustments  are  properly  recorded.  Financial 
and  other  infonnation  is  disclosed  fairly  and  at  appropriate  amounts. 

•  Presentation  and  disclosure — the  financial  and  other  infonnation  in  the  financial 
statements  is  appropriately  presented  and  described  and  disclosures  are  clearly 
expressed.  All  disclosures  that  should  have  been  included  in  the  financial 
statements  have  been  included.  Disclosed  events  and  transactions  have  occurred 
and  pertain  to  the  entity. 


1  The  Financial  Audit  Manual  (FAM)  presents  a  methodology  to  perform  financial  statement  audits  of 
federal  entities  in  accordance  with  professional  standards  established  by  the  American  Institute  of  Certified 
Public  Accountants  (AICPA),  GAGAS,  Office  of  Management  and  Budget  and  the  Federal  Accounting 
Standards  Advisory  Board  (FASAB). 
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Fund  Balance  with  Treasury 

The  Fund  Balance  with  Treasury  (FBWT)  account  (U.S.  Standard  General  Ledger 
account  1010)  is  an  asset  account  unique  to  the  U.S.  government  that  represents 
unexpended  spending  authority.  Entities  record  their  budget  spending  authority  in  FBWT 
accounts  with  an  offsetting  amount  to  unexpended  appropriations — U.S.  Standard 
General  Ledger  account  series  3100.  Similar  to  cash  in  commercial  bank  accounts, 

FBWT  amounts  increase  as  funds  are  collected  and  decrease  as  amounts  are  paid.  Most 
entities  have  several  FBWT  accounts  funded  by  different  types  of  appropriations  that  are 
included  in  the  financial  statement  FBWT  account. 

As  of  September  30,  2011,  the  DISA  WCF  balance  in  the  Defense  WCF  cash  account 
was  $251.9  million.  Because  WCF  funds  do  not  expire,  the  $251.9  million  ending 
balance  in  the  DISA  FBWT  account  consisted  of  the  following  disbursement  and 
collection  amounts  from  the  inception  of  the  appropriations2: 

•  $  1 1 .76  billion  in  disbursement  and  $11.88  billion  in  collection  transactions 
processed  through  the  CSD  WCF  account,  and 

•  $52.44  billion  in  disbursement  and  $52.59  billion  in  collection  transactions 
processed  through  the  TSEAS  WCF  account. 

The  accuracy  of  several  entity  financial  statements,  including  the  Balance  Sheet,  the 
Statement  of  Net  Cost,  and  the  Statement  of  Budgetary  Resources  are  impacted  by  the 
FBWT  account.  Therefore,  any  material  deficiencies  in  the  FBWT  account  would  have  a 
significant  impact  on  the  reliability  of  the  DISA  financial  statements. 

Property,  Plant,  and  Equipment 

The  DoD  requires  that  all  assets  acquired  by  Other  Defense  Organizations  be  recognized 
for  accountability  and  financial  reporting  purposes.  Recognition  requires  the  proper 
accounting  treatment,  such  as  the  reporting  of  capitalized  amounts  and  depreciation  on 
the  appropriate  DoD  Component’s  financial  statements.  General  Property,  Plant,  and 
Equipment  (PP&E),  consists  of  tangible  assets  that  meet  all  of  the  following  criteria:  (1) 
have  an  estimated  useful  life  of  2  years  or  more;  (2)  are  not  intended  for  sale  in  the 
ordinary  course  of  business;  (3)  are  acquired  or  constructed  with  the  intention  of  being 
used  or  available  for  use  by  the  entity;  and  (4)  have  an  initial  acquisition  cost,  book  value, 
or  when  applicable,  an  estimated  fair  market  value  that  equals  or  exceeds  the  DoD 
capitalization  threshold.  The  DoD  capitalization  threshold  is  $100,000  with  the 
exception  of  real-property  assets.  When  recording  the  acquisition  cost  of  the  asset  in  the 
property  accountability  system  of  record  and  the  accounting  system,  the  asset  should  be 


2  The  $251.9  million  ending  balance  also  included  $13.27  million  in  original  funding  and  a  $31.85  million 
adjustment  to  the  TSEAS  account. 
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assigned  a  dollar  value  and  that  dollar  value  should  be  supported  by  appropriate 
documentation. 

Review  of  Internal  Controls 

DoD  Instruction  5010.40,  “Managers’  Internal  Control  Program  (MICP)  Procedures,” 
July  29,  2010,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  that  provides  reasonable  assurance  that  programs  are  operating  as 
intended  and  to  evaluate  the  effectiveness  of  the  controls.  We  identified  one  internal 
control  weakness  for  the  delegation  of  contract  administration  responsibilities  at  DISA. 
Specifically,  the  Director,  Procurement  and  Logistics  Directorate  prohibited  the 
contracting  officer’s  representative  from  completing  key  duties  required  to  provide 
oversight  of  Acuity’s  work  to  assure  the  DoD  that  the  work  perfonned  satisfied  the 
Generally  Accepted  Government  Auditing  Standards.  We  will  provide  a  copy  of  the 
report  to  the  senior  official  in  charge  of  internal  controls  at  DISA. 
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Finding.  Acuity’s  Auditing  Procedures  to 
Support  Its  Opinion  on  the  DISA  FY  2011 
Working  Capital  Fund  Financial  Statements 
Were  Not  Effective 

Acuity  Consulting  (Acuity)  auditing  procedures  on  the  Defense  Infonnation  Systems 
Agency’s  (DISA)  FY  2011  Working  Capital  Fund  (WCF)  Financial  Statements  were 
inadequate.  Specifically,  Acuity  did  not: 

•  properly  perfonn  testing  on  the  DISA  FBWT  reconciliations, 

•  detennine  whether  the  undistributed  accounts  were  free  of  material  misstatements, 

•  adequately  assess  whether  the  deficiencies  identified  by  DISA  in  its  FBWT 
memorandums  for  record  (MFRs)  would  have  a  material  impact  on  the  financial 
statements  and  ultimately  Acuity’s  opinion, 

•  perfonn  adequate  completeness  testing  of  the  TSEAS  Property,  Plant,  and 
Equipment  (PP&E)  line  item,  and 

•  state  in  its  auditor’s  report  that  the  DISA  financial  statement  footnote  disclosures 
were  inadequate  because  they  did  not  discuss  DISA’s  grouped  asset  cost 
activation  and  depreciation  method. 

This  occurred  because  Acuity  did  not  perfonn  the  audit  in  accordance  with  Generally 
Accepted  Government  Auditing  Standards  (GAGAS),  the  Financial  Audit  Manual 
(FAM),  and  the  American  Institute  of  Certified  Public  Accountant  (AICPA)  standards. 
Specifically,  Acuity  relied  on  DISA  management  representations  without  performing 
independent  tests  and  validations.  In  addition,  the  contracting  oversight  was  not 
sufficient  because  the  Director,  Procurement  and  Logistics  Directorate  prohibited  the 
contracting  officer’s  representative  (COR)  from  completing  key  duties  required  to 
provide  oversight  of  Acuity’s  work. 

As  a  result,  Acuity  did  not  have  sufficient  evidence  to  issue  an  unqualified  opinion  on  the 
DISA  FY  2011  WCF  Financial  Statements. 

Furthennore,  without  performing  procedures  that 
ensure  compliance  with  GAGAS,  FAM,  and 
AICPA  standards,  the  DoD  does  not  have 
assurance  that  the  DISA  FY  2011  Financial 
Statements  are  free  of  material  misstatements. 

Acuity  Did  Not  Perform  Sufficient  Audit  Procedures  to 
Support  Its  Audit  Opinion 

On  September  30,  2010,  DISA  awarded  Acuity  a  contract  to  audit  the  DISA  FY  2011 
WCF  Financial  Statements.  The  contract  required  Acuity  to  conduct  the  audit  in 
accordance  with  GAGAS,  FAM,  and  AICPA  standards.  The  contract  also  required 
Acuity  to  express  an  opinion  as  to  whether  DISA  fairly  presented  its  financial  statements. 
However,  Acuity  did  not  perform  key  audit  procedures  to  support  the  audit  opinion  on 


Acuity  did  not  have  sufficient 
evidence  to  issue  an  unqualified 
opinion  on  the  DISA  FY  2011 
WCF  Financial  Statemen  ts. 
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the  DISA  FY  2011  WCF  Financial  Statements.  Specifically,  Acuity’s  procedures  used  to 
test  the  DISA  FBWT  account  and  PP&E  line  item  were  inadequate. 

Acuity’s  Procedures  for  Auditing  the  DISA  FBWT 
Account  Were  Inadequate 

Acuity  did  not  perform  adequate  auditing  procedures  on  the  FBWT  account. 

Specifically,  Acuity  did  not: 

•  perfonn  adequate  auditing  procedures  on  the  DISA  FBWT  reconciliations, 

•  detennine  whether  the  undistributed  accounts  were  free  of  material  misstatement, 
and 

•  adequately  assess  how  the  deficiencies  identified  by  DISA  in  its  FBWT  MFRs 
would  impact  the  reliability  of  the  financial  statements  and  ultimately  Acuity’s 
opinion. 

Acuity  Did  Not  Properly  Test  the  DISA  FBWT  Reconciliations 

Acuity’s  procedures  for  auditing  the  DISA  FBWT  reconciliations  were  inadequate. 
According  to  DoD  OIG  Report  No.  DODIG-2012-107  the  reconciliation  of  the  FBWT 
account  is  a  key  internal  control  process  to  identify  unauthorized  and  improperly 
recorded  transactions.  However,  DISA  is  included  in  U.S.  Treasury  Index  97,  an 
aggregate  account  that  does  not  identify  the  separate  Other  Defense  Organizations 
sharing  the  U.S.  Treasury  account.  As  a  result, 

DISA  must  reconcile  its  FBWT  account  to  the 
Cash  Management  Report  (CMR)  created  by  the 
Defense  Finance  and  Accounting  Service  (DFAS) 

Indianapolis,  instead  of  reconciling  directly  to  the 
U.S.  Treasury.  The  CMR  is  similar  to  an  account 
summary  that  a  commercial  bank  reports  on  a 
customer’s  individual  monthly  bank  statement.  However,  unlike  a  monthly  bank 
statement,  the  CMR  does  not  contain  a  list  of  the  individual  transactions  charged  to  the 
account  during  the  month.  Instead,  the  CMR  reports  only  the  summary  amounts  for  each 
appropriation.  Therefore,  the  Other  Defense  Organizations  must  perfonn  alternate 
procedures  when  reconciling  their  FBWT  accounts.  A  proper  Other  Defense 
Organization  FBWT  reconciliation  would  require  that  DISA: 

•  retrieve  the  disbursement  and  collection  transactions  processed  by  the  disbursing 
offices  to  support  the  summary  amounts  on  the  CMR, 

•  reconcile  the  detail  disbursements  and  collections  supporting  the  CMR  to  the 
detail  disbursements  and  collections  reported  in  the  accounting  systems,  and 

•  research,  and  if  necessary,  resolve  any  variances  between  the  transactions 
supporting  the  CMR  and  the  transactions  in  the  accounting  system. 


The  reconciliation  of  the  FBWT 
account  is  a  key  internal  control 
process  to  identify  unauthorized 
and  improperly  recorded 
transactions. 


However,  Acuity  obtained  only  the  detailed  transactions  recorded  in  the  accounting 
system.  Acuity  then  summed  the  transactions  in  the  accounting  system  and  compared 
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that  summary  amount  to  the  summary  amount  supporting  the  CMR.  FAM  section  350 
states  that  the  auditor  should  use  a  combination  of  audit  procedures  to  obtain  sufficient, 
appropriate  audit  evidence  regarding  the  operating  effectiveness  of  controls.  Acuity 
acknowledged  that  re-performing  the  FBWT  reconciliations,  identifying  reconciling 
items,  and  obtaining  explanations  for  the  reconciling  items  were  necessary  procedures 
that  they  should  have  perfonned  when  testing  the  DISA  FBWT  reconciliations. 

However,  to  re-perform  the  FBWT  reconciliations,  Acuity  would  need  to  obtain  both  the 
detailed  transactions  supporting  the  CMR  and  the  detailed  transactions  reported  in  the 
accounting  system.  Without  reconciling  the  detailed  transactions  supporting  the  CMR  to 
the  detailed  transactions  in  the  accounting  system,  Acuity  could  not  have  re-performed 
and  tested  the  DISA  FBWT  reconciliations  at  the  detailed  transaction  level  to  ensure: 

•  controls  over  the  FBWT  account  were  effective, 

•  adjustments  to  the  financial  statements  were  supported,  and 

•  the  universe  of  disbursements  and  collections  sampled  by  Acuity  was  complete. 

After  we  brought  this  to  the  attention  of  Acuity  senior  management,  Acuity  later  stated 
that  it  ensured  the  detailed  transactions  supporting  the  CMR  equaled  summary  values 
reported  on  the  CMR.  Documentation  provided  by  Acuity  shows  that  the  auditors  then 
compared  the  summary  amount  supporting  the  CMR  to  the  summary  amount  in  the 
accounting  system.  However,  a  proper  re-performance  of  the  DISA  FBWT 
reconciliations  would  require  that  Acuity  reconcile  the  disbursements  and  collections 
supporting  the  CMR  to  the  disbursements  and  collections  reported  in  the  accounting 
system  at  the  detail  transaction  level.  Therefore,  the  procedures  Acuity  stated  it 

performed  still  would  not  represent  adequate 
auditing  procedures  over  the  DISA  FBWT 
reconciliations.  A  transaction  level  FBWT 
reconciliation  will  identify  the  transactions  that  have 
been  disbursed  or  collected  by  the  U.S.  Treasury  and 
subsequently  reported  on  the  CMR,  but  have  not  yet 
been  reported  in  the  accounting  system.  By  only 
performing  a  summary  level  reconciliation  of  the  FBWT  account  and  then  only  testing 
transactions  recorded  in  the  accounting  system,  the  FBWT  universe  that  Acuity  sampled 
did  not  include  any  of  the  transactions  that  make  up  the  $3 1 .9  million  difference  between 
the  amount  reported  on  the  CMR  and  amount  reported  in  the  accounting  system. 

Acuity  also  acknowledged  that  it  did  not  include  the  validation  of  the  CMR  in  its  audit 
documentation,  which  would  have  required  them  to  obtain  and  document  all  of  the 
detailed  transactions  supporting  the  summary  amounts  on  the  CMR.  GAGAS,  paragraph 
4.19,  states  that  audit  documentation  for  financial  audits  performed  in  accordance  with 
government  auditing  standards  should  contain  sufficient  information  to  enable  an 
experienced  auditor  who  has  had  no  previous  connection  with  the  audit  to  ascertain  from 
the  audit  documentation  the  evidence  that  supports  the  auditors’  significant  judgments 
and  conclusions. 


The  procedures  Acuity  stated 
it  performed  still  would  not 
represent  adequate  auditing 
procedures  over  the  DISA 
FBWT  reconciliations. 
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Acuity  Did  Not  Determine  Whether  the  Undistributed  Accounts 
Were  Free  of  Material  Misstatements 

Acuity  did  not  determine  whether  the  TSEAS  and  CSD  “Undistributed  Disbursements” 
accounts  were  free  of  material  misstatements.  Acuity  detennined  that  the  balances  in 
the  TSEAS  undistributed  account,  totaling  $15.3  million  and  the  CSD  undistributed 
account,  totaling  $929,000,  were  both  above  the  allocated  materiality3 4  threshold  for  the 
FBWT  account.  However,  Acuity  did  not  adequately  follow-up  on  these  identified 
deficiencies. 

During  the  audit  of  the  DISA  FY  2011  WCF  Financial  Statements,  Acuity  issued  a 
Notification  of  Finding  (NoF)  to  DISA,  which  stated  that  DISA: 

•  was  unable  to  identify,  explain,  or  clear  specific  transactions  remaining  in  the 
pool  of  transactions  categorized  as  timing  differences, 

•  did  not  consistently  reconcile  the  undistributed  disbursement  account  to  identify 
and  clear  aged  undistributed  amounts,  and 

•  did  not  segregate  the  unsupported  undistributed  amounts  from  the  supported 
undistributed  amounts  on  the  journal  entry. 

Additionally,  the  NoF  stated  that  DISA  management’s  inability  to  effectively  monitor 
transactions  in  the  undistributed  disbursement  account  could  lead  to  undetected 
accounting  record  errors  and  material  misstatements  to  the  financial  statements. 
However,  Acuity  did  not  perform  any  additional 
work  on  the  identified  issue. 

AICPA  AU  Section  312,  “Audit  Risk  and 
Materiality  in  Conducting  an  Audit,”  states  that  the 
auditor  should  document  the  auditor’s  conclusion 
as  to  whether  uncorrected  misstatements, 
individually  or  in  aggregate,  do  or  do  not  cause  the 
financial  statements  to  be  materially  misstated,  and 
the  basis  for  that  conclusion.  Additionally, 

FAM  section  1003  states  that  the  auditor  should  consider  the  status  of  all  known 
significant  findings  and  recommendations,  including  whether  any  failure  to  correct 
previously  identified  deficiencies  in  internal  controls  is  a  significant  deficiency  or 


DISA  management ’s  inability  to 
effectively  monitor  transactions  in 
the  undistributed  disbursement 
account  could  lead  to  undetected 
accounting  record  errors  and 
material  misstatements 


3  Undistributed  accounts  are  intended  to  reduce  accounts  payable  by  the  disbursements  that  have  been 
posted  to  the  U.S.  Treasury,  but  not  yet  posted  in  the  accounting  system. 

4  AICPA  AU  Section  320  requires  the  auditor  to  apply  the  concept  of  materiality  appropriately  in  planning 
and  performing  the  audit.  Materiality,  which  is  determined  by  the  auditor  based  on  professional  judgment, 
is  applied  in  evaluating  the  effect  of  identified  misstatements  on  the  audit  and  the  effect  of  uncorrected 
misstatements,  if  any,  on  the  financial  statements.  Misstatements  are  considered  to  be  material  if  they, 
individually  or  in  the  aggregate,  could  reasonably  be  expected  to  influence  the  economic  decisions  of  users 
made  on  the  basis  of  the  financial  statements. 
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material  weakness.  Without  following  up  on  the  material  unresolved  differences 
identified  in  the  undistributed  accounts,  Acuity 
had  no  assurance  that  material  misstatements 
did  not  exist  in  the  FBWT  account  when  it 
issued  an  unqualified  opinion  on  the  DISA  FY 
2011  WCF  Financial  Statements. 

AICPA  AU  Section  339,  Audit  Documentation, 
states  that  the  auditor  should  document 
significant  findings  or  issues,  actions  taken  to  address  them  (including  any  additional 
evidence  obtained),  and  the  basis  for  the  final  conclusions  reached.  However,  Acuity 
acknowledged  it  did  not  follow  up  on  the  activity  in  the  undistributed  accounts  and  did 
not  ensure  the  deficiencies  were  factored  into  its  opinion  on  the  financial  statements. 
Furthennore,  Acuity  recognized  that  its  audit  documentation  did  not  explicitly  discuss  the 
risk,  materiality,  and  impact  on  the  financial  statements. 

Acuity  Did  Not  Address  Material  Audit  Trail  Deficiencies 

Acuity  did  not  adequately  assess  whether  the  deficiencies  identified  by  DISA  in  its 
FBWT  MFRs  would  have  a  material  impact  on  the  financial  statements  and  ultimately 
Acuity’s  opinion.  DISA  developed  the  MFRs  in  April  2010  to  address  prior  year 
deficiencies  related  to  CSD  and  TSEAS  FBWT  balances.  DISA  stated  in  the  MFRs  they 
purged  $7.8  billion  in  detailed  transactions  from  the  accounting  system  and  performed 
approximately  $379  million  in  unsupported  adjustments.  Specifically,  DISA  stated  that: 

•  for  CSD,  they  imported  $5.2  billion  into  the  Financial  Accounting  Management 
Infonnation  System  in  FY  2003  based  on  budgetary  execution  reports,  rather  than 
transaction  detail,  and  prepared  a  $186.9  million  adjustment  to  “rebuild”  the 
general  ledger  FBWT  balance, 

•  for  TSEAS,  they  purged  $2.6  billion  in  disbursements  and  collections  when 
switching  to  the  Financial  Accounting  Management  Infonnation  System,  and 
prepared  two  adjustments  to  “rebuild”  the  general  ledger  FBWT  balance  in  the 
amounts  of  $97.9  million  and  $94  million. 

DoD  7000. 14-R,  “Financial  Management  Regulation”  Volume  6A,  Chapter  2  requires 
DoD  components  to  maintain  audit  trails  in  sufficient  detail  to  pennit  tracing  of 
transactions  and  balances  from  its  sources  to  amounts  reported  in  its  systems.  Audit  trails 
are  necessary  to  demonstrate  the  accuracy,  completeness,  and  timeliness  of  a  transaction. 
Additionally,  the  DoD  Financial  Management  Regulation  Volume  4,  Chapter  2  states  that 
documentation  must  be  available  to  auditors  and  management  to  provide  an  audit  trail 
and  support  accomplished  reconciliations  and  resulting  adjustments.  However,  DISA  did 
not  have  audit  trails  to  support  over  $7.8  billion  in  detailed  transactions  and 
approximately  $379  million  in  unsupported  adjustments  to  its  accounting  records. 

Without  the  detailed  transactions  to  support  these  amounts,  Acuity  could  not  have  fully 
tested  the  FBWT  account  for  existence,  completeness,  and  accuracy.  Additionally, 
unlike  appropriated  funds,  WCF  funds  do  not  ever  expire.  Therefore,  these  deficiencies 
will  remain  as  long  as  the  accounts  exist. 


Acuity  acknowledged  it  did  not 
follow  up  on  the  activity  in  the 
undistributed  accounts  and  did  not 
ensure  the  deficiencies  were 
factored  into  its  opinion. 
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DISA  did  not  disclose  any  of  the  deficiencies  reported  in  its  MFRs  in  the  notes  to  the 
financial  statements.  In  addition.  Acuity  did  not  identify  that  the  footnotes  lacked  the 
infonnation  needed  for  fair  presentation  and  disclosure.  FAM  section  921  states  that  the 
auditor  should  determine  whether  the  entity  has  presented  the  financial  statements  and 
footnote  disclosures  for  the  FBWT  account  in  accordance  with  U.S.  Generally  Accepted 
Accounting  Principles.  Specifically,  FAM  section  921  states  that  the  auditor  should 
assess  whether  the  entity  disclosed  and  explained: 

•  material  unreconciled  differences  in  the  notes  to  the  financial  statements,  and 

•  material  unreconciled  differences  that  were  written  off  by  the  entity  during  the 
fiscal  year  in  the  notes  to  the  financial  statements. 

Acuity  acknowledged  that  it  should  have  included  a 
paragraph  in  the  audit  opinion  that  alerted  the  reader 
to  the  problems  documented  in  the  MFRs  and  that  it 
would  consider  the  impact  of  the  deficiencies  on  the 
overall  audit  opinion.  Additionally,  Acuity  stated  that 
the  deficiencies  should  have  been  reported  in  the 
financial  statement  note  disclosures  and  additional 
disclosures  were  under  consideration.  Finally,  Acuity 
stated  that  one  of  the  reasons  it  was  willing  to  render  an  unqualified  opinion  on  the 
financial  statements  with  the  audit  trail  issues  was  because  DISA  had  implemented 
sustainable  procedures  and  controls  to  accurately  record,  trace,  and  reconcile  the  FBWT 
account.  However,  as  previously  stated,  Acuity  did  not  perform  adequate  procedures  on 
the  FBWT  reconciliations  to  determine  if  controls  over  the  FBWT  account  were 
effective. 

Acuity  also  recognized  that  its  audit  documentation  did  not  explicitly  discuss  the  risk, 
materiality,  and  impact  of  the  MFRs  on  the  financial  statements.  GAGAS,  paragraph 
4.19,  states  that  audit  documentation  for  financial  audits  performed  in  accordance  with 
government  auditing  standards  should  contain  sufficient  infonnation  to  enable  an 
experienced  auditor  who  has  had  no  previous  connection  with  the  audit  to  ascertain  from 
the  audit  documentation  the  evidence  that  supports  the  auditors’  significant  judgments 
and  conclusions. 

Acuity’s  Reliance  on  DISA  Management 

Acuity  relied  on  representations  by  DISA  management  and  did  not  independently 
validate  the  representations  made  by  DISA.  Specifically,  Acuity: 

•  performed  only  summary  reconciliations  of  the  FBWT  account  and  did  not 
adequately  test  to  ensure  DISA  was  performing  regular  and  recurring  FBWT 
reconciliations  at  the  detailed  level, 

•  accepted  a  response  from  DISA  regarding  the  deficiencies  in  the  undistributed 
accounts,  but  did  not  perfonn  any  follow  up  work  on  the  account  to  ensure  the 
undistributed  accounts  could  be  supported,  and 


Acuity  stated  that  the 
deficiencies  should  have  been 
reported  in  the  financial 
statement  note  disclosures  and 
additional  disclosures  were 
under  consideration. 
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•  accepted  the  deficiencies  DISA  reported  in  the  MFRs  without  performing 
adequate  auditing  procedures  to  detennine  if  the  deficiencies  would  have  a 
material  impact  on  the  FBWT  account. 

GAGAS  paragraph  4.03  requires  an  auditor  to  gain  a  sufficient  understanding  of  internal 
controls  to  plan  the  audit  and  obtain  sufficient  appropriate  audit  evidence  to  render  an 
opinion  on  the  financial  statements.  Furthermore,  FAM  section  1001,  “Management 
Representations”  states  that  management  representations  are  not  a  substitute  for  obtaining 
other  audit  evidence. 

Auditing  Procedures  of  the  General  Property,  Plant,  and 
Equipment  Line  Item  Could  be  Improved 

Acuity  did  not  perform  procedures  to  detennine  whether  the  PP&E  line  item  in  the  DISA 
FY  2011  WCF  Financial  Statements  was  free  of  material  misstatements.  Specifically, 
Acuity  did  not: 

•  perfonn  adequate  completeness  testing  of  the  TSEAS  PP&E  line  item,  and 

•  state  in  its  auditor’s  report  that  the  DISA  financial  statement  footnote  disclosures 
were  inadequate  because  they  did  not  discuss  DISA’s  grouped  asset  cost 
activation  and  depreciation  method. 

Completeness  Testing  of  Property  Plant  and  Equipment 

Acuity  did  not  perform  adequate  testing  of  the  TSEAS  Network  PP&E  to  verify  DISA 
compliance  with  the  completeness  assertion.  Specifically,  Acuity  did  not  perfonn 
(floor  to  book)5  tests  to  verify  the  completeness  of 
DISA’s  property  accountability  system.  The  Defense 
Property  Accountability  System  (DPAS)  is  the 
system  of  record  used  by  DISA  to  record  PP&E. 

Accounting  infonnation  in  DPAS  is  automatically 
interfaced  with  and  transmitted  to  DoD  accounting 
systems.  FAM  section  1003  suggests,  in  order  to 
verify  completeness,  the  auditor  should  test  transactions  in  the  accounts  payable  ledger 
against  supporting  property  records  to  determine  whether  all  items  that  should  have  been 
recorded  were  recorded.  Instead,  to  verify  completeness,  Acuity  acknowledged  it  could 
not  rely  on  DPAS,  so  it  perfonned  alternate  procedures  to  reduce  its  risk  with  respect  to 
the  DISA  completeness  assertion.  However,  we  determined  that  the  conclusions  of  those 
alternative  procedures  were  not  adequately  supported. 


Acuity  did  not  perform  (floor 
to  book)  tests  to  verify  the 
completeness  of  DISA ’s 
property  accountability 
system. 


5  The  floor  to  book  test  is  a  method  of  verifying  completeness  of  the  accounting  and  property  records 
through  physical  matching  of  an  asset  to  its  corresponding  entry  in  the  property  system  of  record. 
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For  example,  Acuity  provided  its  asset  valuation  testing  as  an  alternative  procedure.  The 
testing  required  the  auditor  to  detennine  whether  the  acquisition  cost  of  the  asset  was 
supported  and  verified  by  reviewing  the  asset  funding  and  acquisition  documents.  Acuity 
selected  6  high-dollar  value  assets  valued  at  $37.7  million  out  of  31  TSEAS  assets  valued 
at  $49.3  million  in  the  PP&E  1790  and  1791  general  ledger  account  balances.  Of  the  six 
assets  tested,  the  auditor  found  no  discrepancies  with  the  samples,  but  provided  no 
supporting  documentation  to  show  how  the  auditor  reached  its  conclusions.  The  FAM 
section  290  states  that  the  auditor  should  prepare  audit  documentation  in  sufficient  detail 
to  provide  a  clear  understanding  of  the  work  perfonned,  the  audit  evidence  obtained  and 
its  source  and  the  conclusions  reached.  Additionally,  GAGAS,  paragraph  4.19,  states 
audit  documentation  for  financial  audits  performed  in  accordance  with  government 
auditing  standards  should  contain  sufficient  information  to  enable  an  experienced  auditor 
who  has  had  no  previous  connection  with  the  audit  to  ascertain  from  the  audit 
documentation  the  evidence  that  supports  the  auditors’  significant  judgments  and 
conclusions.  In  its  workpapers,  Acuity  auditors  noted  that  D1SA  tried  repeatedly  to 
obtain  1080  bills  from  the  Business  Transfonnation  Agency,  but  were  unsuccessful. 

1080  bills  are  a  standard  fonn  which  constitutes 
an  official  request  to  pay  for  services  delivered 
that  present  only  summary  data  on  charges  to  the 
agency.  Since  Acuity  did  not  include  sufficient 
documentation  to  support  the  results  of  its 
analysis,  it  did  not  support  its  use  of  the 
alternative  procedures  for  completeness  testing. 

Therefore,  the  alternate  procedures  were  inadequate  to  support  its  opinion  on  the 
completeness  assertion  as  it  relates  to  TSEAS  PP&E. 

Acuity  Did  Not  State  that  the  DiSA  Financial  Statement  Footnote 
Disclosures  Were  Inadequate  in  Its  Auditor’s  Report 

Acuity  did  not  state  in  its  auditor’s  report  that  the  DISA  financial  statement  footnote 
disclosures  were  inadequate  because  it  did  not  discuss  DISA’s: 

•  Grouped  Asset  Cost  Method,  and 

•  Grouped  Asset  Activation  and  Depreciation  Method. 

Specifically,  GAGAS  chapter  5.03(c)  states  that  when  the  auditor  determines  that 
infonnative  disclosures  are  not  reasonably  adequate,  the  auditor  must  state  so  in  the  auditor’s 
report.  The  DISA  grouped  asset  methods  deviated  from  the  standards  authorized  under 
the  DoD  FMR.  These  deviations  were  required  to  be  disclosed  in  the  notes  to  the 


Since  Acuity  did  not  include 
sufficient  documentation  to 
support  the  results  of  its  analysis, 
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alternative  procedures  for 
completeness  testing. 
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financial  statements  or  the  management  discussion  and  analysis  (MD&A)6  section  of  the 
financial  statements.  Acuity  was  aware  of  the  methods,  and  aware  that  DISA  did  not 
include  the  disclosures  in  the  financial  statements  or  the  MD&A,  but  made  no  mention  of 
the  inadequate  disclosures  in  its  auditor’s  report. 

DISA  Did  Not  Disclose  Grouped  Asset  Cost  Method 

During  the  review  of  FY  2011  beginning  balances,  Acuity  issued  a  NOF  discussing  the 
DISA  grouped  asset  cost  method.  Acuity  stated  that  the  NOF  was  caused  from  DISA 
using  a  grouped  asset  costs  approach  rather  than  the  individual  cost  approach  to  identify 
and  value  assets.  The  DoD  FMR  volume  4,  chapter  6  states  entries  to  record  PP&E  must 
include  sufficient  infonnation  including  physical  quantity,  location,  and  unit  cost  of  the 
PP&E  to  enable  periodic  independent  verification  of  the  accuracy  of  the  property 

accountability  records.  Acuity  stated  that  DISA 
records  grouped  assets  with  descriptions  such  as 
“Additional  Costs”  or  “Systems”  making  it  difficult 
to  identify,  observe,  or  verify  the  individual 
physical  asset.  Acuity  detennined  that  the  effect  of 
the  grouped  asset  cost  method  increased  the 
likelihood  that  a  material  misstatement  would  not 
be  prevented  or  detected.  DISA  provided  a  response  to  the  NOF  that  acknowledged  the 
challenges  with  the  method  and  stated  they  designed  a  new  business  processes  to  support 
a  more  sustainable  approach  while  making  the  process  more  effective  for  review. 
However,  DISA  did  not  state  the  problem  or  the  action  taken  in  the  MD&A  section  of  the 
report  or  in  the  notes  to  the  financial  statements. 

DISA  Did  Not  Disclose  Grouped  Asset  Activation  and 
Depreciation  Method  in  its  Financial  Statements 

The  DISA  grouped  asset  activation  and  depreciation  method  deviated  from  the  standards 
in  the  DoD  FMR.  DISA  based  the  grouped  asset  activation  and  depreciation 
methodology  primarily  from  the  standards  in  the  Statement  of  Federal  Financial 
Accounting  Standards  No.  6  and  more  specifically  from  the 

DoD  FMR  volume  4,  chapter  6.  Statement  of  Federal  Financial  Accounting  Standards 
No.  6  states  that  various  methods  can  be  used  to  compute  periodic  depreciation  expense 
as  long  as  the  method  is  systematic,  rational  and  best  reflects  the  use  of  PP&E.  This 
standard  also  states  that  a  composite  or  group  depreciation  methodology  is  permissible 
where  cost  of  PP&E  is  depreciated  using  the  same  rate.  More  specifically,  the  DoD 
FMR,  volume  4,  chapter  6  states  that  the  recorded  cost  of  PP&E  assets  shall  be  the 


Acuity  determined  the  effect  of 
the  grouped  asset  cost  method 
increased  the  likelihood  that  a 
material  misstatement  would 
not  be  prevented  or  detected. 


6  Each  federal  financial  report  includes  an  MD&A  section  that  addresses  the  reporting  entity's  program  and 
financial  performance  measures,  financial  statements,  systems  and  controls,  compliance  with  laws  and 
regulations,  and  actions  taken  or  planned  to  address  problems. 
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purchase  contract  cost  plus  ancillary  costs.7  The  DISA  recorded  costs  of  assets  are 
actually  component  individual  assets  grouped  together  that  may  have  been  received  over 
the  course  of  a  year  or  more. 

The  DoD  FMR  states  that  to  begin  depreciating  assets,  assuming  the  assets  have  the  same 
recovery  period;  the  event  that  triggers  the  calculation  of  depreciation  is  the  date  of 
receipt  or  the  date  installed  and  placed  in  service.  The  DISA  method  deviates  from  the 
DoD  FMR  policy  because  the  DISA  grouped  assets  are  composed  of  assets  having 
different  recovery  periods.  For  example,  the  Defense  Infonnation  System  Network  is 
composed  of  computer  equipment  and  network  cables.  The  DoD  FMR  classifies 
computers  and  peripherals  into  a  5-year  recovery  period  and  fiber  optic  cable  into  a 
20-year  recovery  period.  Consequently,  the  DISA  method  of  grouping  assets  with  long 
and  short  recovery  periods  together  increases  the 
likelihood  that  useable  equipment  would  be 
replaced  earlier  than  necessary.  Additionally, 
because  certain  components  of  a  network  may  be 
received  over  the  course  of  a  year  or  more  without 
being  activated,  the  assets  waiting  to  be  grouped 
together  and  placed  in  service  could  potentially  be 
fully  depreciated  by  the  time  the  network  is  actually  activated. 

Lastly,  the  DoD  FMR  specifies  two  methods  for  depreciation  commencement — the 
Month  Available  for  Service  Method  or  the  Mid-Year  Convention  Method.  However, 
DISA  starts  asset  depreciation  in  September  of  the  year  the  grouped  asset  is  activated. 
This  method  deviates  from  the  standards  set  forth  for  depreciation  commencement  in  the 
DoD  FMR.  However,  DISA  did  not  disclose  any  of  the  issues  with  the  grouped  asset 
cost  activation  and  depreciation  method  in  its  financial  statements. 

Acuity’s  Audit  Report  Did  Not  State  that  the  DISA  Informative 
Disclosures  Were  Inadequate 

Acuity  did  not  comply  with  GAGAS  because  it  did  not  state  in  the  auditor’s  report  that  the 
DISA  informative  disclosures  were  inadequate.  The  DISA  grouped  asset  cost  method  and 
the  activation  and  depreciation  method  are  not  in  accordance  with  accounting  policy  for 
PP&E  in  the  DoD  FMR.  Statements  on  Auditing  Standards  No.  1,  section  420, 
Consistency  of  Application  of  Generally  Accepted  Accounting  Principles,  states  that 
changes  in  accounting  standards  that  have  a  material  effect  on  the  financial  statements 
may  require  disclosure  in  a  note  to  the  financial  statements.  Additionally  the  Office  of 
Management  and  Budget  A- 136,  Financial  Reporting  Requirements 
(Revised  September  29,  2010),  states  that  management  should  discuss  important 


DISA  did  not  disclose  any  of  the 
issues  with  the  grouped  asset 
cost  activation  and  depreciation 
method  in  its  financial 
statements. 


7  Examples  of  ancillary  costs  include  the  following:  engineering,  architectural,  and  other  outside  services 
for  designs,  plans,  specifications,  and  surveys. 
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problems  that  need  to  be  addressed  and  actions  that  have  been  planned  or  taken  to 
address  those  problems  in  the  MD&A  section  of  the  statement.  However,  DISA  did  not 
provide  informative  disclosure  of  the  grouped  asset  methodologies  in  either  the  notes  or 
the  MD&A  section  of  the  financial  statements.  Additionally,  GAGAS  chapter  5.03(c) 
states  that  when  the  auditor  determines  that  the  financial  statement  footnote  disclosures  are 
not  reasonably  adequate;  the  auditor  must  state  so  in  the  auditor’s  report. 

In  FY  2012,  Acuity  expressed  concerns  about  the  depreciation  methodology  to  DISA. 
DISA  sought  an  opinion  on  the  matter  from  the  Federal  Accounting  Standards  Advisory 
Board  through  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller).  As  of  the 
date  of  our  post-audit  review,  the  matter  was  unresolved. 

The  Contracting  Officer’s  Representative  Was  Unable  to 
Complete  Key  Duties  to  Provide  Oversight 

The  COR  was  prohibited  from  completing  key  duties  required  to  provide  oversight  of 
Acuity’s  work  to  assure  the  DoD  that  the  work  perfonned  satisfied  GAGAS.  The  COR 
used  the  FAM  section  650  as  guidance  to  conduct  contract  oversight  of  Acuity  and  ensure 
its  compliance  with  GAGAS.  The  FAM  section  650,  “Using  the  Work  of  Others”  states 
that  the  auditor  should  develop  an  audit  strategy  and  audit  plan  for  reviewing  and  testing 
the  work  done.  The  FAM  section  650  also  states  that  the  auditor  will  assist  the 
contracting  officer  to  ensure  contractor  compliance  with  the  terms  and  conditions  of  the 
contract. 

Although  the  COR  did  not  review  all  required  deliverables  obtained  from  Acuity 
throughout  the  audit,  some  key  documents  were  reviewed  and  concerns  were  identified 
with  Acuity’s  work.  For  example,  the  COR  provided 
comments  on  documents  received  in  the  planning 
phase,  including  the  Plan  of  Action  &  Milestones.  In 
addition,  the  COR  expressed  concerns  that  Acuity 
failed  to  provide  a  detailed  audit  plan.  FAM  section 
210,  “Overview  of  the  Planning  Phase”  states  that 
the  auditor  must  adequately  plan  the  audit  work  and 
the  auditor  should  develop  effective  and  efficient 
ways  to  obtain  the  sufficient  appropriate  evidence 

necessary  to  report  on  the  federal  entity’s  financial  statements.  The  COR  stated  that 
Acuity  did  not  provide  a  complete  audit  plan  until  February  201 1,  4  months  after  the 
beginning  of  the  audit. 

When  the  COR  was  asked  why  they  did  not  execute  the  duties  as  outlined  in  the 
perfonnance  work  statement,  the  COR  stated  that  the  Director,  Procurement  and 
Logistics  Directorate  (PLD)  did  not  allow  them  to  fully  perfonn  their  duties.  For 
example,  the  Director,  PLD,  who  was  the  contracting  officer’s  supervisor,  directed  the 
COR: 


Although  the  COR  did  not 
review  all  required  deliverables 
obtained  from  Acuity 
throughout  the  audit,  some  key 
documents  were  reviewed  and 
concerns  were  identified  with 
Acuity ’s  work. 


•  not  to  have  any  discussions  with  Acuity  regarding  the  criteria  that  Acuity  was 
contractually  obligated  to  follow, 
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•  not  to  have  the  COR/ Acuity  In-Process  Review  unless  Acuity  requested  the 
meeting, 

•  not  to  engage  Acuity  in  any  meetings, 

•  to  continue  to  pick  up  workpapers  from  Acuity  on  a  biweekly  basis,  and 

•  to  address  any  issues  to  the  Director,  PLD,  who  would  then  decide  if  the  issues 
should  be  addressed  with  Acuity. 

By  placing  these  restrictions  on  the  COR,  the  Director,  PLD  prevented  the  COR  from 
completing  essential  steps  that  could  have  provided  indications  that  Acuity  was  not 
perfonning  the  audit  in  accordance  with  audit  standards  and  was  not  in  compliance  with 
the  contract.  The  Director,  PLD  is  not  a  certified  public  accountant,  nor  an  experienced 
auditor.  In  addition,  the  Director,  PLD  does  not  hold  a  contracting  warrant.  Therefore, 
the  Director,  PLD  was  not  qualified  to  provide  effective  oversight  of  a  financial  statement 
audit  or  determine  what  issues  should  be  addressed  by  Acuity.  However,  the  Director, 
PLD  limited  the  COR,  a  qualified  individual,  from  doing  the  job  they  were  assigned.  The 
Director,  PLD  stated  that  Acuity  felt  that  the  COR 
was  impeding  their  progress  because  they  were 
spending  excessive  time  helping  the  COR 
understand  the  work  they  were  doing  and  why  they 
were  doing  it.  As  the  audit  progressed,  the  COR  did 
not  solicit  comments  from  DISA  management  or 
provide  feedback  to  Acuity  because  the  COR  was  instructed  by  the  Director,  PLD  not  to 
have  any  discussions  with  Acuity  or  engage  Acuity  in  any  meetings.  The  COR  obtained 
copies  of  Acuity’s  workpapers  on  a  biweekly  basis,  but  did  not  review  the  workpapers, 
based  on  the  direction  provided  by  the  Director,  PLD.  In  addition,  based  on  the  direction 
received  from  the  Director,  PLD,  the  COR  did  not  provide  comments  or  feedback  to 
Acuity’s  draft  audit  report  or  the  management  representation  letter  as  stated  in  the 
perfonnance  work  statement.  Therefore,  the  COR  accepted  services  performed  by 
Acuity  without  perfonning  the  appropriate  level  of  review.  As  a  result,  the  COR 
approved  payments  to  Acuity  without  ensuring  they  satisfied  the  contract  requirements. 

Audit  Standards  Require  Reissuance  of  Auditor’s  Report 

AU  Section  390,  Consideration  of  Omitted  Procedures,  states  that  if  an  auditor  concludes 
that  an  omission  of  auditing  procedures  considered  necessary  at  the  time  of  the  audit 
impairs  his  present  ability  to  support  a  previously  expressed  opinion,  he  should  promptly 
apply  the  omitted  procedure  or  alternative  procedures  that  would  provide  a  satisfactory 


The  Director ,  PLD  limited  the 
COR,  a  qualified  individual, 
from  doing  the  job  they  were 
assigned. 


s  A  warrant  is  the  monetary  authority  delegated  to  the  contracting  officer.  Contracting  officers  may  bind 
the  Government  only  to  the  extent  of  the  authority  delegated  to  them.  Contracting  officers  shall  receive 
clear  instructions  in  writing  from  the  appointing  authority  regarding  the  limits  of  their  authority.  However, 
based  on  management  comments  received  from  the  Vice  Director,  DISA,  the  Director,  PLD,  as  the  Head  of 
Contracting  Activity,  was  delegated  procurement  authorities,  including  authority  to  enter  into  and 
administer  contracts  from  the  Director,  DISA. 
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basis  for  his  opinion.  Additionally,  when  the  auditor  becomes  aware  of  facts  that  existed 
at  the  date  of  the  report  that  would  have  affected  the  report  had  he  been  aware  of  them, 
the  auditor  should  follow  the  provisions  of  section  561.05-09,  Subsequent  Discovery  of 
Facts. 

AU  Section  561,  Subsequent  Discovery  of  Facts,  Chapter  .05  states,  in  part,  that  when  the 
subsequently  discovered  infonnation  is  found  to  be  reliable,  existed,  and  material  to  the 
financial  statements  at  the  date  of  the  auditor’s  report,  the  auditor  should  take  action  to 
prevent  further  reliance  on  the  report.  Chapters  .06  through  .08  go  on  to  state  that  if  the 
effect  on  the  subsequently  discovered  information  can  be  promptly  detennined,  the 
auditor  should  notify  users  of  the  report  that  the  auditor’s  report  must  no  longer  be 
associated  with  the  financial  statements.  Notification  can  be  provided  through  the  web 
page  where  the  original  report  was  published.  Therefore,  the  auditor  should  withdraw  the 
original  audit  opinion  and  issue  a  revised  auditor’s  report.  The  reason  for  the  revision 
should  be  disclosed  in  the  new  auditor’s  report. 

DISA  Contract  Required  Acuity  Compliance  with  Generally 
Accepted  Government  Auditing  Standards 

The  DISA  audit  contract  required  that  Acuity  comply  with  standards  applicable  to 
financial  audits  contained  in  the  Government  Auditing  Standards  issued  by  the 
Comptroller  General  of  the  United  States.  Because  Acuity  did  not  have  sufficient 
evidence  to  issue  an  unqualified  opinion  on  the  FY  2011  DISA  WCF  Financial 
Statements,  its  work  did  not  comply  with  GAGAS.  The  Financial  Acquisition  Regulation 
Clause  52.212-4  “Contract  Terms  and  Conditions”  states  that  the  Government  may  seek 
an  equitable  price  reduction  or  adequate  consideration  for  nonconfonning  services  when 
the  contractor  has  not  performed  to  contract  standards. 

DoD  Manual  7600. 07-M  states  that  substandard 
work  by  a  non-Federal  auditor  may  warrant 
referral  for  sanctions  by  the  appropriate  licensing 
authorities  or  suspension  and  disbarment  by  the 
contracting  authority.  Furthennore,  a  referral 
would  be  appropriate  when  work  has  significant 
inadequacies  that  make  the  audit  so  pervasively 
deficient  that  users  cannot  rely  on  it.  If  the 
circumstances  justify  a  referral,  the  audit 
organization  shall  forward  the  appropriate  documentation  and  a  memorandum  with  the 
reason  for  the  proposed  referral  action  to  the  Assistant  Inspector  General  for  Audit  Policy 
&  Oversight.  Based  on  the  deficiencies  identified  in  this  report,  we  provided  a  referral  to 
the  Assistant  Inspector  General  for  Audit  Policy  &  Oversight. 

Conclusion 

Acuity  did  not  have  sufficient  evidence  to  issue  an  unqualified  opinion  on  the  FY  2011 
DISA  WCF  Financial  Statements.  Furthennore,  without  perfonning  procedures  that 
ensure  compliance  with  GAGAS,  FAM,  and  AICPA  standards,  the  DoD  does  not  have 
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the  assurance  that  the  DISA  FY  2011  Financial  Statements  were  free  of  material 
misstatements. 


Additionally,  AICPA  AU  Section  508,  Reports  on  Audited  Financial  Statements,  states 
that  if  the  auditors  are  unable  to  obtain  sufficient  audit  evidence  to  support  management’s 
assertions  about  the  nature  of  a  matter  involving  an  uncertainty  and  its  presentation  or 
disclosure  in  the  financial  statements,  the  auditor  should  consider  the  need  to  express  a 
qualified  opinion  or  to  disclaim  an  opinion  because  of  a  scope  limitation.  Accordingly, 
because  Acuity  did  not  have  sufficient  evidence  to  support  its  audit  opinion,  it  should 
withdraw  their  opinion,  and  users  of  the  financial  statements  should  be  notified. 

Recommendations,  Management  Comments,  and  Our 
Response 

1.  We  recommend  that  the  Director,  Defense  Information  Systems  Agency: 

a.  Review  the  actions  of  the  Director,  Procurement  and  Logistics 

Directorate  to  determine  whether  the  director  acted  within  the  scope  of 
her  authority  and  take  appropriate  corrective  action  as  necessary. 

Director,  DISA  Comments 

The  Vice  Director,  DISA,  responded  for  the  director,  agreed  with  the 
recommendation.  He  stated  they  are  reviewing  the  actions  of  the  Director, 
Procurement  and  Logistics  Directorate  and  have  noted  that,  based  on  the  FAR, 
the  Director,  Procurement  and  Logistics  Directorate,  as  the  head  of 
contracting  activity,  was  delegated  procurement  authorities,  including 
authority  to  enter  into  and  administer  contracts  from  the  Director,  DISA. 
Additionally,  he  stated  that  the  FAR  authorizes  the  contracting  officer  to 
specify  the  duties  of  the  COR.  Adjustment  of  the  COR’s  duties  is  within  the 
scope  of  the  contracting  officer’s  authority.  Therefore,  corrective  action  on  the 
issue  of  authority  is  not  necessary. 

Our  Response 

The  comments  of  the  Vice  Director,  DISA  were  partially  responsive.  Based 
on  their  review,  the  Vice  Director,  DISA  stated  that  corrective  action  was  not 
necessary.  The  contracting  officer  has  a  responsibility  to  specify  the  duties  of 
the  COR  and  has  the  authority  to  adjust  those  duties  as  needed.  However, 
DISA’s  response  did  not  fully  address  the  actions  of  the  Director,  PLD. 
Although  the  Director,  PLD  was  designated  as  the  Head  of  Contracting 
Authority  and  has  also  been  delegated  “all  procurement  authorities  of  the 
Director  of  DISA,”  the  Director,  PLD  is  not  qualified  to  provide  oversight 
over  a  financial  statement  audit  or  detennine  what  issues  should  be  addressed 
by  Acuity.  In  cases  where  the  contracting  officer  does  not  possess  the 
technical  competency  needed  to  ensure  compliance  with  audit  standards,  FAR 
1 .602-2(c)  states  contracting  officers  shall  request  the  advice  of  specialists  in 
audit  as  appropriate.  Yet,  the  Director,  PLD  did  not  seek  the  advice  of  the 
COR,  who  was  the  specialist  in  audit  standards.  Therefore,  we  ask  that  the 
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Director,  DISA  provide  additional  comments  to  the  final  report  identifying 
appropriate  corrective  action  to  ensure  that  the  Director,  PLD  does  not  impede 
on  the  contract  oversight  responsibilities  on  future  financial  statement  audits. 

b.  Ensure  that  the  responsibilities  of  individuals  performing  contract 
oversight  of  financial  statement  audits  are  fulfilled  by  a  qualified, 

General  Schedule  0511  series  Defense  Information  Systems  Agency 
employee. 

Director,  DISA  Comments 

The  Vice  Director,  DISA,  agreed  with  the  recommendation,  and  stated  they 
will  use  employees,  including  General  Schedule  05 1 1  employees  and  other 
qualified  employees,  depending  on  the  duties  that  need  to  be  perfonned. 

Our  Response 

The  comments  of  the  Vice  Director,  DISA  were  responsive,  and  no  further 
comments  are  required. 

c.  Seek  a  refund  from  Acuity  Consulting  for  the  audit  services  not  provided 
on  the  Defense  Information  Systems  Agency  FY  2011  Working  Capital 
Fund  Financial  Statements  contract. 

Director,  DISA  Comments 

The  Vice  Director,  DISA  stated  that  they  believed  the  IPA  was  fulfilling  its 
legal  contract  requirements  throughout  the  execution  of  the  auditing  service 
contract.  DISA  continues  to  review  this  matter.  As  part  of  the  review,  DISA 
will  have  to  determine  whether  there  is  a  basis  to  seek  a  refund  given  that 
perfonnance  of  the  contract  is  complete.  DISA  stated  they  will  need  the 
support  of  the  Department  if  they  detennine  there  is  a  reason  to  seek  a  refund. 

Our  Response 

The  comments  of  the  Vice  Director,  DISA  were  partially  responsive. 

Although  the  Vice  Director,  DISA  stated  that  they  would  continue  to  review 
this  matter,  DISA  did  not  state  whether  they  concur  or  nonconcur  with  our 
recommendation.  Additionally,  this  report,  which  illustrates  the  results  of  our 
review,  serves  as  the  basis  for  DISA  to  seek  a  refund  from  Acuity.  Therefore, 
we  ask  that  DISA  obtain  advice  from  their  General  Counsel  on  the  matter  of 
seeking  a  refund  and  provide  additional  comments  in  response  to  the  final 
report  identifying  concurrence  or  nonconcurrence  and  corrective  action  taken 
on  the  recommendation. 

2.  We  recommend  that  the  Managing  Partner,  Acuity  Consulting: 

a.  Withdraw  the  unqualified  opinion  on  the  audit  of  the  Defense 
Information  Systems  Agency  FY  2011  WCF  Financial  Statements. 
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Managing  Partner,  Acuity  Comments 

The  Managing  Partner,  Acuity  stated  they  disagreed  with  the  DoD  OIG’s 
position  because  they  had  sufficient  and  appropriate  evidence  to  provide  a 
reasonable  basis  for  an  unqualified  opinion  on  the  DISA  FY  2011  WCF 
Financial  Statements.  The  Managing  Partner,  Acuity  also  stated  they 
considered  the  risk  of  material  misstatement  associated  with  each  material 
assertion,  account,  or  class  of  transactions  and  obtained  sufficient  and 
appropriate  evidence  to  reduce  the  risk  of  material  misstatement  to  an 
acceptable  level.  The  Managing  Partner,  Acuity  stated  the  procedures 
performed  complied  with  GAGAS,  FAM,  and  AICPA  standards. 

Our  Response 

The  comments  of  the  Managing  Partner,  Acuity  were  nonresponsive.  Our 
review  as  discussed  in  this  report  clearly  demonstrates  that  Acuity  did  not 
have  sufficient  evidence  to  issue  an  unqualified  opinion  on  DISA’s  FY  2011 
WCF  Financial  Statements.  After  review  of  all  evidence  provided  by  Acuity, 
we  determined  that  it  did  not: 

•  properly  test  the  DISA  Fund  Balance  with  Treasury  reconciliations, 

•  detennine  whether  the  undistributed  accounts  were  free  of  material 
misstatements, 

•  adequately  assess  whether  the  deficiencies  identified  by  DISA  in  its 
FBWT  Memoranda  for  Record  would  have  a  material  impact  on  the 
financial  statements  and  Acuity’s  opinion, 

•  perfonn  adequate  testing  on  PP&E,  and 

•  state  in  its  auditor’s  report  that  the  DISA  financial  statement 
disclosures  were  inadequate. 

We  request  the  Managing  Partner,  Acuity  reconsider  their  position  on  the 
recommendation  regarding  withdrawal  of  the  unqualified  opinion  on  the  audit 
of  the  DISA  FY  2011  Working  Capital  Fund  Financial  Statements. 

b.  Review  the  planned  work  on  future  audits  and  incorporate  the 

appropriate  audit  steps  into  their  audit  plan  to  gather  sufficient  evidence 
to  support  their  opinion. 


Managing  Partner,  Acuity  Comments 

The  Managing  Partner,  Acuity  stated  they  are  mindful  of  the  importance  of 
each  plan  being  designed  to  meet  the  real-world  issues  of  an  audit.  Where  the 
purpose  of  the  audit  is,  for  example,  to  verify  the  factual  existence  of  objects, 
then  it  may  be  appropriate  to  verify  all  external  sources.  When,  as  here,  the 
purpose  is  to  design  a  risk-based  approach,  then  it  is  appropriate  to  exercise 
professional  judgment  as  to  what  constitutes  sufficient  appropriate  audit 
evidence  by  considering  factors  such  as  the  significance  of  the  potential 
misstatement  in  the  relevant  assertion  and  the  likelihood  of  its  having  a 
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material  effect,  individually  or  aggregated  with  other  potential  misstatements, 
on  the  financial  statements. 

Our  Response 

The  comments  of  the  Managing  Partner,  Acuity  were  nonresponsive.  The 
comments  did  not  contain  concurrence  or  nonconcurrence,  corrective  actions, 
and  an  estimated  completion  date.  Therefore,  we  ask  that  Acuity  provide 
additional  comments  in  response  to  the  final  report  identifying  concurrence  or 
nonconcurrence  with  our  recommendation. 
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Appendix  A.  Scope  and  Methodology 

We  conducted  this  post  audit  review  from  March  2012  through  January  2013  in 
accordance  with  GAGAS.  Those  standards  require  that  we  plan  and  perform  the  post 
audit  review  to  obtain  sufficient  appropriate  evidence  to  provide  a  reasonable  basis  for 
our  findings  and  conclusions  based  on  our  objectives.  We  believe  that  the  evidence 
obtained  provides  a  reasonable  basis  for  our  findings  and  conclusions. 

We  interviewed  and  obtained  documentation  from  the  contracting  officer,  contracting 
officer’s  representative,  and  the  Director  of  the  Procurement  and  Logistics  Directorate  at 
DISA  Headquarters  in  Ft.  Meade,  MD  to  understand  their  roles  and  responsibilities  for 
the  oversight  of  the  DISA  FY  2011  WCF  Financial  Statement  audit.  We  interviewed 
personnel  from  Acuity  and  obtained  their  working  paper  documentation  from  their  audit 
of  the  DISA  FY  2011  WCF  Financial  Statement  audit. 

IPA  Audit  Procedures:  We  reviewed  the  FBWT,  PP&E,  and  Accounts  Payable  line 
items  based  on  the  value  of  the  line  items  to  the  total  of  the  balance  sheet.  We  compared 
the  audit  procedures  performed  by  Acuity  regarding  FBWT,  PP&E,  and  Accounts  Payable  to 
the  requirements  in  the  GAGAS,  FAM,  and  the  AICPA  standards.  We  reviewed  Acuity’s 
sampling  procedures  documented  in  the  working  papers  for  the  FBWT,  PP&E,  and 
Accounts  Payable  line  items  and  its  analysis  to  determine  the  adequacy  of  its 
conclusions.  We  reviewed  the  performance  work  statement  for  the  contract  and  the  FY 
2010  ending  balance  sheet  accounts  for  FBWT,  PP&E,  and  Accounts  Payable. 

Contract  Oversight:  We  identified  and  reviewed  guidance  applicable  to  the  COR 
functions  and  responsibilities  as  prescribed  in  the  DISA  Acquisition  Regulation 
Supplement  Section  1.6  and  the  performance  work  statement.  We  collected  and  reviewed 
the  COR  files,  specifically,  the  contract,  memorandums,  in  process  review  write  ups, 
audit  committee  meeting  minutes,  and  correspondence  between  DISA  and  Acuity  staff  to 
review  the  oversight  work  that  was  performed  and  documented  by  the  COR. 

Use  of  Computer  Processed  Data 

We  used  computer  processed  data  to  perform  this  post  audit  review.  Specifically,  we 
used  data  developed  by  Acuity  during  its  audit  from  DP  AS  and  the  Financial  Accounting 
Management  Information  System.  We  also  relied  on  Excel  spreadsheets,  Word 
documents,  and  Adobe  portable  document  fonnat  files  created  by  Acuity  and  DISA. 

We  compared  data  developed  by  Acuity  to  determine  if  it  had  sufficient  documentation  to 
support  conclusions  reached  in  its  auditor’s  report.  From  these  procedures,  we  concluded 
that  the  data  were  sufficiently  reliable  for  our  audit  purposes. 

Use  of  Technical  Assistance 

The  Quantitative  Methods  Division  reviewed  and  tested  the  Independent  Public 
Accountant  sampling  methodology  to  evaluate  the  quality  of  the  work  and  to  detennine 
whether  the  projections  derived  from  the  sampling  methodology  were  accurate  and 
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reasonable.  We  used  subject  matter  experts  to  assist  the  team  with  the  analysis  of  FBWT 
and  WCF  property  information. 


Prior  Coverage 

During  the  last  5  years,  the  Department  of  Defense  Office  of  Inspector  General 
(DoD  OIG)  has  issued  two  reports  discussing  the  oversight  of  contracted  audit  services. 
Unrestricted  DoD  OIG  reports  can  be  accessed  at  http://www.dodig.mil/pubs. 


DoD  OIG 

DoD  OIG  Report  No.  D-2012-1 16,  “External  Quality  Control  Review  of  the  Defense 
Information  Systems  Agency  Audit  Organization,”  August  7,  2012 

DoD  OIG  Report  No.  D-2009-6-003,  “Key  Strategies  and  Practices  for  Oversight  of  DoD 
Contracted  Audit  Services,”  March  3,  2009 
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Appendix  B.  Acuity’s  Comments  on  the 
Finding  and  Our  Response 

Acuity’s  Comments  on  Sufficient  Audit  Procedures  to  Support 
Its  Audit  Opinion 

The  Managing  Partner,  Acuity  stated  they  disagreed  with  the  DoD  OIG’s  position 
because  they  had  sufficient  and  appropriate  evidence  to  provide  a  reasonable  basis  for  an 
unqualified  opinion  on  the  DISA  FY  2011  WCF  Financial  Statements.  The  Managing 
Partner,  Acuity  also  stated  they  considered  the  risk  of  material  misstatement  associated 
with  each  material  assertion,  account,  or  class  of  transactions  and  obtained  sufficient  and 
appropriate  evidence  to  reduce  the  risk  of  material  misstatement  to  an  acceptable  level. 
The  Managing  Partner,  Acuity  stated  the  procedures  perfonned  complied  with  GAGAS, 
FAM,  and  AICPA  standards. 

Our  Response 

AU  Section  339  states  that  the  auditor  should  prepare  audit  documentation  that  enables 
an  experienced  auditor,  having  no  previous  connection  to  the  audit,  to  understand: 

•  the  nature,  timing,  and  extent  of  auditing  procedures  performed  to  comply  with 
Statements  on  Auditing  Standards  and  applicable  legal  and  regulatory 
requirements, 

•  the  results  of  the  audit  procedures  performed  and  the  audit  evidence  obtained, 

•  the  conclusions  reached  on  significant  matters,  and 

•  that  the  accounting  records  agree  or  reconcile  with  the  audited  financial 
statements  or  other  audited  infonnation. 

However,  Acuity  did  not  have  sufficient  evidence  to  issue  an  unqualified  opinion  on 
DISA’s  FY  2011  WCF  Financial  Statements.  After  review  of  all  evidence  provided  by 
Acuity,  we  detennined  that  it  did  not: 

•  properly  test  the  DISA  FBWT  reconciliations, 

•  detennine  whether  the  undistributed  accounts  were  free  of  material  misstatements, 

•  adequately  assess  whether  the  deficiencies  identified  by  DISA  in  its  FBWT  MFR 
would  have  a  material  impact  on  the  financial  statements  and  Acuity’s  opinion, 

•  perfonn  adequate  testing  on  PP&E,  and 

•  state  in  its  auditor’s  report  that  the  DISA  financial  statement  disclosures  were 
inadequate. 

For  our  responses  to  Acuity’s  comments  regarding  FBWT  and  PP&E,  please  see  pages 
25  and  30,  respectively. 
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Acuity’s  Comments  on  Properly  Testing  DISA  FBWT 
Reconciliations 

The  Managing  Partner,  Acuity  stated  they  disagreed  that  their  work  was  inadequate.  The 
Managing  Partner,  Acuity  stated  that  their  audit  approach  controlled  the  risk  of  material 
misstatement  to  an  acceptable  level.  The  Managing  Partner,  Acuity  also  stated  they 
perfonned  substantive  audit  procedures  related  to  the  financial  statement  reporting 
process.  Specifically,  the  Managing  Partner,  Acuity  stated  they: 

•  observed  DISA’s  FBWT  reconciliation  processes  and  reviewed  them, 

•  perfonned  an  independent  reconciliation  of  FBWT  and  the  CMR,  including 
detailed  substantive  and  internal  control  testing  of  collection  and  disbursement 
transactions, 

•  perfonned  a  reconciliation  of  CMR  cash  activity  to  the  AR(M)  1307  Report  and 
Net  Outlays  on  the  Standard  Form  133, 

•  examined  and  performed  an  independent  reconciliation  of  the  DFAS-Indianapolis 
SF  133  Reconciliation  to  the  Cash  Balance  at  the  .05  level,  which  was  from  a 
reliable  independent  source,  and 

•  reconciled  the  ending  Defense  Working  Capital  Fund  FBWT  balance  to  the 
balance  reported  on  the  Government  Wide  Accounting  reports,  another  reliable 
independent  source  (that  is,  U.S.  Department  of  Treasury). 

In  addition,  the  Managing  Partner,  Acuity  stated  they  prepared  supplemental  summary 
workpapers  subsequent  to  the  audit  to  more  clearly  document  the  work  performed  and  tie 
related  work  together  to  facilitate  a  review  by  an  independent  reviewer.  On  August  30, 
2012,  they  provided  these  workpapers  to  the  DoD  OIG. 

Our  Response 

AU  Section  318  states  that  the  auditor  should  use  a  combination  of  audit  procedures  to 
obtain  sufficient,  appropriate  audit  evidence  that  controls  are  operating  effectively.  In 
Acuity’s  August  30,  2012  written  response  to  the  DoD  OIG,  the  Managing  Partner 
acknowledged  that  audit  principles  require  them  to  perform  the  reconciliations,  identify 
reconciling  items,  and  obtain  explanations  for  the  reconciling  items. 

A  proper  Other  Defense  Organizations’  FBWT  reconciliation  should  include  the 
following  steps: 

•  retrieving  the  disbursement  and  collection  detail  processed  by  the  disbursing 
offices  to  support  the  summary  amounts  on  the  CMR, 

•  reconciling  the  disbursements  and  collections  supporting  the  CMR  to  the 
disbursements  and  collections  reported  in  the  accounting  system;  to  have  an 
adequate  audit  trail  for  the  reconciliation  of  the  Other  Defense  Organizations’ 
FBWT  accounts,  it  is  essential  to  have  both  the  transactions  supporting  the 
amounts  on  the  CMR  and  the  transactions  supporting  the  amounts  in  the 
accounting  system,  and 
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•  researching,  and  if  necessary  resolving,  any  variances  between  the  transactions 
supporting  the  CMR  and  the  transactions  in  the  accounting  system. 

Acuity  has  not  provided  any  audit  documentation  throughout  the  course  of  the  audit  to 
demonstrate  that  it  had  adequately  performed  and  tested  the  DISA  FBWT  reconciliations. 
Rather,  in  its  August  30,  2012  response  to  the  DoD  OIG,  it  reiterated  the  work  it  had 
done,  which  only  included  summary  reconciliations  and  detail  testing  of  disbursements 
and  collections.  However,  as  already  noted  in  this  report,  summary  FBWT 
reconciliations  are  not  adequate  to  ensure  controls  over  the  FBWT  account  were  effective 
and  that  adjustments  to  the  financial  statements  were  supported.  AU  Section  326  states 
that  the  auditor  should  obtain  and  evaluate  evidential  matter  concerning  the  assertions  in 
such  financial  statements  when  fonning  its  opinion  on  the  financial  statements.  Without 
properly  testing  the  FBWT  reconciliations,  Acuity  could  not  have  ensured  all  transactions 
that  should  have  been  recorded  were  recorded.  As  a  result,  Acuity  could  not  have 
validated  DISA  management’s  completion  assertion. 

In  the  August  30,  2012  response  to  the  DoD  OIG,  the  Managing  Partner,  Acuity  stated 
that  requesting  and  obtaining  all  of  the  transactions  that  comprise  the  CMR  would  be  akin 
to  asking  a  commercial  client  to  require  their  financial  institution  provide  all  the 
transactions  they  process.  However,  DISA  is  required  to  reconcile  its  FBWT  at  the 
transaction  level  on  a  regular  and  recurring  basis  and  are  also  required  to  maintain  the 
detailed  reconciliations  for  the  auditors.  Therefore,  DISA  should  have  these  transactions 
readily  available.  The  comment  provided  by  the  Managing  Partner,  Acuity  on  August  30, 
2012  indicates  the  fact  that  DISA  is  either  not  properly  performing  regular  and  recurring 
FBWT  reconciliations  at  the  detail  level  or  Acuity  did  not  properly  audit  the  account. 
While  Acuity  has  stated  that  it  observed,  reviewed,  and  tested  the  DISA  FBWT 
reconciliations,  Acuity’s  workpapers  did  not  contain  any  documentation  supporting  this 
assertion.  Audit  standards  require  the  audit  documentation  to  stand  on  its  own. 

AU  Section  339  and  GAGAS  Section  4.19  state  that  audit  documentation  for  financial 
audits  should  contain  sufficient  infonnation  to  enable  an  experienced  auditor  who  has  had 
no  previous  connection  with  the  audit  to  ascertain  from  the  audit  documentation  the 
evidence  that  supports  the  auditors’  significant  judgments  and  conclusions.  In  the  case  of 
Acuity’s  work  perfonned  on  the  DISA  FBWT  reconciliations,  the  audit  documentation 
did  not  comply  with  these  standards. 


Acuity’s  Comments  on  Determining  Whether  the  Undistributed 
Accounts  Were  Free  of  Material  Misstatement 

The  Managing  Partner,  Acuity  stated  they  disagreed  with  DoD  OIG’s  conclusion  that 
Acuity  did  not  adequately  follow  up  on  the  identified  deficiencies.  The  Managing 
Partner,  Acuity  stated  that  the  report  does  not  specifically  articulate  why  DoD  OIG 
believes  Acuity’s  procedures  might  result  in  an  unacceptable  risk  of  material 
misstatement.  Specifically,  the  Managing  Partner,  Acuity  stated  they: 
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•  performed  interim  tests  of  the  accounts  payable  undistributed  accounts  as  part  of 
baseline  testing  and  throughout  the  year,  including  Q2  (CSD),  Q3  (CSD  and 
TSEAS),  and  Q4  (CSD  and  TSEAS),  which  identified  DISA’s  continuous 
improvement  in  analyzing  and  understanding  the  nature  of  the  transactions  in  this 
account  and  the  resulting  ability  to  reduce  the  volume  of  transactions  and  value  of 
accounts  payable  undistributed  disbursements,  and 

•  perfonned  audit  procedures  that  provided  sufficient  and  appropriate  evidence  to 
provide  a  reasonable  basis  for  the  conclusion  regarding  accounts  payable 
undistributed  disbursements. 

The  Managing  Partner,  Acuity  stated  they  perfonned  an  audit  procedure  to  analyze  the 
accounts  payable  undistributed  disbursement  transaction  activity  in  October  2011, 
comparing  to  the  transactions  comprising  the  reported  balance  on  September  30,  2011, 
and  determined  the  related  transactions  had  cleared  through  the  nonnal  process.  The 
Managing  Partner,  Acuity  stated  it  appears  the  DoD  OIG  did  not  consider  the  results  of 
the  subsequently  performed  procedure  or  their  conclusion  that  there  was  no  risk  of 
material  misstatement. 

Our  Response 

During  the  audit  of  the  DISA  FY  2011  WCF  Financial  Statements,  Acuity  detennined 
that  the  balances  in  the  CSD  undistributed  account,  totaling  $0.93  million,  and  the 
TSEAS  undistributed  account,  totaling  $15.3  million,  were  both  material  deficiencies. 
Specifically,  Acuity  reported  that: 

•  DISA  was  unable  to  identify,  explain,  or  clear  specific  transactions  remaining  in 
the  pool  of  transactions  categorized  as  timing  differences, 

•  DISA  did  not  consistently  reconcile  the  undistributed  disbursement  account  to 
identify  and  clear  aged  undistributed  amounts,  and 

•  DISA  did  not  segregate  the  journal  entry  for  unsupported  undistributed  amounts 
from  the  journal  entry  for  the  undistributed  amounts  that  can  be  supported. 

Acuity  concluded  that  DISA  management’s  inability  to  effectively  monitor  transactions 
in  the  undistributed  disbursement  account  could  lead  to  undetected  accounting  record 
inaccuracies  and  potentially  material  misstatements  to  the  financial  statements.  Despite 
identifying  the  material  deficiencies  during  the  course  of  the  audit,  Acuity  still  issued  an 
unqualified  opinion  on  the  DISA  FY  2011  WCF  Financial  Statements.  In  fact,  only  after 
the  DoD  OIG  infonned  Acuity  that  it  did  not  perform  sufficient  auditing  procedures  on 
the  undistributed  accounts  did  Acuity  provide  any  additional  workpapers  on  the 
undistributed  accounts  that  it  reported  as  being  materially  deficient.  However,  Acuity  did 
not  provide  these  additional  workpapers  on  the  undistributed  accounts  until  August  30, 
2012,  10  months  after  the  unqualified  opinion  was  rendered.  AU  Section  339  states  that 
the  auditor  should  document  significant  findings  or  issues,  actions  taken  to  address  them, 
and  the  basis  for  the  final  conclusions  reached.  Acuity  did  not  comply  with  the 
aforementioned  auditing  standard  by  not  following  up  on  the  deficiencies  they  identified 
in  the  undistributed  account  during  the  FY  2011  DISA  WCF  financial  statement  audit  in 
a  timely  manner. 
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While  the  work  Acuity  provided  to  the  DoD  OIG  on  August  30,  2012  is  an  improvement 
from  the  procedures  originally  perfonned,  DISA  still  could  not  identify  $233,900  that 
remained  in  the  TSEAS  undistributed  account  and  $1 17,300  that  remained  in  the  CSD 
undistributed  accounts  in  October  2011.  Therefore,  even  though  Acuity  states  that  these 
amounts  are  below  the  materiality  thresholds  for  the  FBWT  accounts,  it  is  possible  that 
the  amounts  calculated  by  Acuity  could  include  transactions  with  negative  and  positive 
amounts.  As  a  result,  when  the  amounts  are  netted  against  one  another,  the  totals  would 
be  much  smaller  than  if  the  amounts  were  calculated  in  the  absolute  form  and 
subsequently  summed.  A  transaction  level  reconciliation  would  have  identified  each 
undistributed  transaction  at  the  detail  level  allowing  DISA  to  identify  each  transaction 
that  was  disbursed  or  collected,  but  not  yet  recorded  in  the  accounting  system.  If  Acuity 
had  adequately  perfonned  and  tested  the  DISA  FBWT  reconciliations,  it  could  have 
identified  the  transactions  supporting  the  accounting  adjustments  at  the  time  the 
adjustments  were  performed. 


Acuity’s  Comments  on  Addressing  Material  Audit  Trail 
Deficiencies 

The  Managing  Partner,  Acuity  stated  although  they  fully  assessed  the  MFR  deficiencies, 
they  determined  they  did  not  clearly  document  all  of  their  conclusions.  The  Managing 
Partner,  Acuity,  stated  that  the  audit  report  does  not  specifically  articulate  why  DoD  OIG 
believes  the  FBWT  MFR  deficiencies  would  impact  Acuity’s  opinion.  The  Managing 
Partner,  Acuity  stated  they  performed  a  risk-based  and  standards-based  audit  approach  in 
accordance  with  AICPA  standards.  Specifically,  the  Managing  Partner,  Acuity  stated 
they: 

•  conducted  a  thorough  review  of  the  documentation  and  data  provided  by  DISA  in 
support  of  the  MFRs, 

•  detennined  the  risk  of  material  misstatement  was  sufficiently  low, 

•  applied  appropriate  procedures  to  test  internal  controls  on  the  FBWT 
reconciliation  process  and  the  collection  and  disbursement  transactions,  and 

•  evaluated  the  reasonableness  of  the  estimated  beginning  balances. 

The  Managing  Partner,  Acuity  stated  the  financial  statements  accompanied  by  the 
auditor’s  report  for  FY  2011  could  have  included  an  explanatory  paragraph  of  emphasis 
and  more  complete  disclosures  for  FBWT.  The  Managing  Partner,  Acuity  stated  that 
DISA  made  the  appropriate  corrections  and  revisions  to  the  note  disclosures  to  the  FY 
2012  comparative  financial  statements.  Additionally,  the  Managing  Partner,  Acuity, 
stated  they  included  an  explanatory  paragraph  in  the  auditor’s  report,  which  was  issued 
November  15,  2012. 

Our  Response 

Throughout  its  validation  efforts  in  the  four  years  leading  up  to  the  FY  2011  DISA  WCF 
Financial  Statements  audit,  Acuity  issued  several  Notifications  of  Findings  and 
Recommendations  to  DISA  with  respect  to  the  FBWT  account.  The  essence  of  these 
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Notifications  of  Findings  and  Recommendations  was  that  the  ending  FBWT  balance  as  of 
September  30,  2007  could  not  be  supported  because  of  insufficient  audit  evidence  and 
insufficient  audit  trails.  After  several  discussions  with  the  Defense  Finance  and 
Accounting  Service  regarding  the  deficiencies,  Acuity  agreed  with  DISA  that  drafting  an 
MFR  was  a  feasible  course  of  action.  The  Managing  Partner,  Acuity  acknowledged  in 
their  response  to  the  draft  report  that  the  original  source  documentation  supporting 
disbursements  and  collections  prior  to  FY  2007  was  still  no  longer  available.  In  doing  so, 
the  Managing  Partner,  Acuity  recognized  that  DISA  still  did  not  have  over  $7.8  billion  in 
detailed  transactions  that  were  purged  from  the  accounting  system  and  also  that  DISA 
performed  approximately  $379  million  in  unsupported  adjustments  that  were  posted  to 
the  accounting  records;  amounts  which  continue  to  impact  the  DISA  FBWT  account. 

Without  the  detail  transactions  to  support  these  amounts,  it  would  have  been  impossible 
for  Acuity  to  have  fully  validated  the  existence,  completeness,  and  accuracy  assertions  of 
the  FBWT  account.  AU  Section  318  states  that  if  the  auditor  has  not  obtained  sufficient 
appropriate  audit  evidence  as  to  a  material  financial  statement  assertion,  the  auditor 
should  attempt  to  obtain  further  audit  evidence.  If  the  auditor  is  unable  to  obtain 
sufficient  appropriate  audit  evidence,  the  auditor  should  express  a  qualified  opinion  or  a 
disclaimer  of  opinion.  It  is  not  clear  to  the  DoD  OIG  how  the  MFR,  an  instrument  DISA 
used  to  document  the  billions  of  dollars  in  material  deficiencies,  would  fix  the  audit 
evidence  and  audit  trail  issues  identified  by  Acuity  in  its  Notifications  of  Findings  and 
Recommendations.  As  a  result,  Acuity  should  have  expressed  a  qualified  opinion  or  a 
disclaimer  of  opinion.  The  Managing  Partner,  Acuity  stated  in  their  response  that  Acuity 
“determined  the  risk  of  material  misstatement  was  sufficiently  low  to  provide  a 
reasonable  basis  for  an  unqualified  opinion  based  on  DISA  FBWT  (that  is,  collection  and 
disbursement)  internal  controls  in  place  since  FY  2007.”  The  FBWT  reconciliation  is  a 
key  internal  control  over  the  FBWT  account.  Therefore,  by  not  adequately  testing  the 
FBWT  reconciliations,  as  we  have  found  to  be  the  case,  the  Managing  Partner,  Acuity, 
did  not  obtain  sufficient  appropriate  evidence  for  an  unqualified  opinion. 

Finally,  the  Managing  Partner,  Acuity,  acknowledged  that  the  financial  statements 
accompanied  by  the  auditor’s  report  for  FY  2011  could  have  included  an  explanatory 
paragraph  of  emphasis  and  more  complete  disclosures  for  FBWT.  However,  Acuity  did 
not  believe  reissuance  of  the  FY  2011  audited  financial  report  was  warranted  and  instead 
ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the  note  disclosures 
in  the  FY  2012  comparative  financial  statements.  Additionally,  Acuity  included  an 
explanatory  paragraph  in  the  FY  2012  audit  report  highlighting  the  issues  discussed  in  the 
MFR.  However,  this  does  not  negate  the  fact  that  the  deficiency  should  have  been 
included  in  the  FY  2011  DISA  WCF  Financial  Statements  and  in  Acuity’s  FY  2011  audit 
report,  because  Acuity  knew  of  this  issue  well  before  August  30,  2012.  AU  Section 
561.06(a)  states  disclosure  should  consist  of  issuing,  as  soon  as  practicable,  revised 
financial  statements  and  auditor’s  report. 
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Acuity’s  Comments  on  Its  Reliance  on  DISA  Management 

The  Managing  Partner,  Acuity  stated  they  acted  in  accordance  with  auditing  standards 
and  were  unbiased  with  respect  to  DISA  management’s  representations  and  exercised 
professional  skepticism.  The  Managing  Partner,  Acuity  stated  they  provided  additional 
documentation  to  tie  related  work  together  to  facilitate  a  review  by  an  independent 
auditor.  The  Managing  Partner,  Acuity  requested  that  the  DoD  OIG  consider  these 
supplemental  workpapers  in  its  present  review  and  update  the  draft  report  to  reflect 
consideration  of  these  documents. 

Our  Response 

As  already  noted  in  our  responses  to  the  Managing  Partner,  Acuity,  the  DoD  OIG 
reviewed  the  supplemental  audit  documentation  provided  by  Acuity  and  still  does  not 
believe  Acuity  performed  adequate  work  to  ensure: 

•  DISA  was  performing  regular  and  recurring  FBWT  reconciliations, 

•  DISA  was  able  to  identify  and  explain  the  undistributed  accounts  at  the  time  the 
accounting  adjustments  were  performed,  leading  to  possible  accounting  record 
inaccuracies  and  potential  material  misstatements,  and 

•  DISA’s  MFRs  pertaining  to  the  FBWT  would  not  affect  the  audit  opinion 
rendered  on  the  DISA  FY  2011  Financial  Statements. 

GAGAS  paragraph  4.03  requires  an  auditor  to  gain  a  sufficient  understanding  of  internal 
controls  to  plan  the  audit,  and  to  obtain  sufficient,  competent,  evidential  matter  to  render 
an  opinion  on  the  financial  statements.  By  not  perfonning  adequate  audit  work  on  the 
three  issues  above,  Acuity  did  not  gain  the  sufficient  evidence  to  issue  an  unqualified 
opinion  on  the  DISA  Financial  Statements. 


Acuity’s  Comments  on  Completeness  Testing  of  Property,  Plant, 
and  Equipment 

The  Managing  Partner,  Acuity  stated  they  performed  risked  based  and  standards  based 
procedures  and  quoted  standards  from  AU  Section  230,  “Due  Professional  Care”  on  all 
components  of  TSEAS  PP&E.  The  Managing  Partner,  Acuity  stated  they: 

•  documented  their  inability  to  rely  on  DPAS  for  certain  classes  of  TSEAS  PP&E 
and  noted  that  they  would  apply  alternative  procedures  for  testing  completeness 
with  respect  to  TSEAS  network  PP&E, 

•  detennined  appropriate  alternative  procedures,  and 

•  tested  the  TSEAS  pending  assets  process  (including  certain  transactions  to  test 
controls)  as  well  as  the  capital  budget  process. 

The  Managing  Partner,  Acuity  stated  their  analysis  as  a  whole  and  the  procedures  they 
performed  with  respect  to  completeness  reduced  the  risk  to  an  acceptable  level. 

The  Managing  Partner,  Acuity  stated  they  prepared  supplemental  summary  workpapers 
subsequent  to  the  audit  to  provide  clarity  with  respect  to  their  conclusions  and  to  more 
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fully  reference  and  link  the  work  performed  throughout  the  audit  to  facilitate  a  review  by 
an  independent  reviewer.  The  Managing  Partner,  Acuity  requested  that  the  DoD  OIG 
consider  these  supplemental  workpapers  in  its  present  review  and  update  the  draft  report 
to  reflect  consideration  of  these  documents. 

Our  Response 

AU  Section  230.10  states  while  exercising  due  professional  care,  the  auditor  must  plan 
and  perfonn  the  audit  to  obtain  sufficient  appropriate  audit  evidence  so  that  audit  risk  will 
be  limited  to  a  low  level  that  is,  in  his  professional  judgment,  appropriate  for  expressing 
an  opinion.  Additionally  GAGAS  3.32  through  3.37  states  that  professional  judgment 
includes  exercising  reasonable  care  and  professional  skepticism.  The  use  of  professional 
judgment  includes  consideration  about  whether  the  audit  team’s  overall  understanding  is 
sufficient  to  assess  the  audit  risk.  Furthennore,  within  the  context  of  audit  risk,  an 
integral  part  of  the  audit  process  is  exercising  professional  judgment  in  determining  the 
sufficiency  and  appropriateness  of  evidence.  Based  on  our  review,  we  determined  that 
Acuity  did  not  meet  the  standard  of  due  professional  care  and  professional  judgment  for 
reasonable  assurance  to  reduce  the  completeness  assertion  on  PP&E  because  its 
alternative  procedures  were  inadequate.  The  alternative  procedures  were  inadequate 
because  Acuity  did  not  obtain  sufficient  appropriate  evidence  for  the  pending  asset 
reconciliation  process  and  the  asset  valuation  process  to  reduce  the  audit  risk  to  a  low 
level. 

Of  the  three  alternative  procedures  performed  by  Acuity,  the  DoD  OIG  only  agrees  with 
the  inclusion  of  the  test  of  budgetary  controls  as  a  reasonable  method  to  reduce  the  risk 
assessment  of  the  completeness  assertion  from  the  highest  level.  The  DoD  OIG 
concluded  that  the  Pending  Asset  Reconciliation  Process  and  asset  valuation  procedures 
that  Acuity  conducted  should  not  have  been  included  in  its  justification  to  reduce  the 
completeness  risk  to  an  acceptable  level.  Therefore,  the  DoD  OIG  determined  that 
because  only  one  of  three  alternative  procedures  were  suitable  to  include  in  its  risk 
assessment  in  conjunction  with  its  acknowledgement  that  during  the  validation  it  could 
not  rely  on  DP  AS,  Acuity  should  have  assessed  the  risk  related  to  material  misstatement 
of  the  completeness  assertion  at  the  high/moderate  level  and  conducted  detailed 
completeness  testing  or  issued  an  opinion  other  than  unqualified  opinion. 

Specifically: 

•  Budget-to-Reporting  Process — Acuity  considered  the  work  performed  during  its 
test  on  DISA’s  budgetary  controls  in  its  assessment  of  risk  with  respect  to  the 
completeness  assertion  on  TSEAS  network  assets.  Acuity  provided  a  summary  of 
its  control  test.  Acuity  assessed  the  effectiveness  of  budgetary  control  activities 
as  effective.  Acuity  matched  the  General  Ledger  Account 
Code  1790  to  the  Office  of  the  Under  Secretary  of  Defense  budget  allotment  for 
TSEAS  and  provided  documentation  in  its  workpapers. 

Based  on  our  review,  we  detennined  that  this  is  an  appropriate  method  of 
ensuring  and  documenting  that  the  cost  in  the  General  Ledger  Account  Code  1790 
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agrees  with  the  appropriation  and  is  supported  by  source  documents.  Therefore, 
we  agree  with  Acuity’s  inclusion  of  its  Budget-to-Reporting  control  testing  as  a 
suitable  alternative  to  include  in  its  justification  to  reduce  the  completeness  risk 
assertion  to  an  acceptable  level. 

•  Pending  Asset  Reconciliation  Process — Acuity  concluded  that  for  baseline  2010 
testing,  the  process  documented  on  the  methodology  of  DISA’s  preparation  of 
monthly  reconciliations  is  reasonable  to  rely  on  for  transactions  in  the  TSEAS 
PP&E  account. 

Based  on  our  review,  we  detennined  Acuity’s  workpapers  do  not  document  its 
analysis  of  DISA’s  reconciliation  process  and  therefore  do  not  meet  the  standards 
in  AU  Section  230  or  GAGAS  3.36-3.37  for  professional  skepticism.  Acuity  did 
not  discuss  what  procedures  it  used  to  determine  the  accuracy  and  validity  of  the 
reconciliations  prepared  and  provided  by  DISA  representatives.  Acuity  only 
refers  to  the  methodology  DISA  used  to  perform  the  reconciliation.  Acuity  did 
not  document  its  basis  for  concluding  the  reconciliation  is  reasonable  or  reliable. 

Therefore,  we  are  unable  to  agree  with  Acuity’s  conclusions  regarding  the 
reasonableness  of  the  reconciliation  process  and  do  not  agree  with  Acuity’s 
decision  to  include  its  review  of  the  pending  asset  reconciliation  process  as  a 
justification  to  reduce  the  completeness  risk  to  an  acceptable  level. 

•  Asset  Valuation — Acuity  used  its  asset  valuation  analysis  to  support  its 
justification  of  reducing  the  completeness  risk  to  an  acceptable  level.  Acuity 
performed  valuation  testing  on  the  high-dollar  value  items  from  the  FY  2011 
year-end  reconciliations.  To  conclude  the  valuations,  Acuity  perfonned  attribute 
testing  on  sampled  line  items  to  detennine  whether  a  valid  Military 
Interdepartmental  Purchase  Request  exists,  the  contract  amount  reconciled, 
acquisition  cost  of  the  asset  was  supported,  and  whether  the  amount  paid  agrees  to 
the  total.  Acuity  concluded  that,  based  on  its  testing,  the  valuations  of  the 
program  lines  were  reasonable. 

Therefore,  Acuity  concluded  its  valuation  work  could  be  relied  upon  to  support  its 
justification  to  reduce  the  risk  with  respect  to  the  completeness  assertion 
sufficiently  low  to  conclude  that  the  TSEAS  PP&E  financial  statement  line  item 
was  not  materially  misstated  due  to  unrecorded  assets. 

Based  on  our  review,  Acuity  conducted  attribute  testing  on  five  1790  General 
Ledger  Account  Code’s  and  one  1791  General  Ledger  Account  Code.  Acuity 
found  no  exceptions  with  any  of  the  samples.  However,  Acuity  did  not  provide 
any  source  documentation  to  substantiate  the  results  of  its  testing.  AU  Section 
339.06  states  that  abstracts  or  copies  of  the  entity’s  records  should  be  included  as 
part  of  the  audit  documentation  if  they  are  needed  to  enable  an  experienced 
auditor  to  understand  the  work  performed  and  conclusions  reached.  Because 
Acuity  did  not  include  any  source  documentation  in  its  workpapers  to  support  its 
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conclusions,  its  workpapers  did  not  meet  the  standards  in  AU  section  339  for 
audit  documentation.  GAGAS,  Paragraph  4. 19(c),  states  that  audit  documentation 
for  financial  audits  performed  in  accordance  with  GAGAS  should  contain 
sufficient  information  to  enable  an  experienced  auditor  who  has  had  no  previous 
connection  with  the  audit  to  ascertain  from  the  audit  documentation  the  evidence 
that  supports  the  auditors’  significant  judgments  and  conclusions.  Additionally, 
the  U.S.  Government  Accountability  Office  and  the  President’s  Council  on 
Integrity  and  Efficiency  (GAO/PCIE)  FAM  290  states  that  the  auditor  must 
prepare  audit  documentation  in  sufficient  detail  to  provide  a  clear  understanding 
of  the  work  perfonned  (including  the  nature,  extent,  and  timing  and  results  of 
audit  procedures  performed),  the  audit  evidence  obtained  and  its  source,  and  the 
conclusions  reached.  Acuity  added  comment  boxes  referring  to  the  lack  of 
documentation  to  support  the  “Y”  or  “yes”  for  their  response  to  the  attribute  being 
tested. 

Therefore,  we  detennined  that  because  Acuity  did  not  include  sufficient 
documentation  to  support  the  results  of  its  analysis,  we  could  not  agree  with  its 
inclusion  of  its  asset  valuation  testing  to  support  its  justification  of  reducing  the 
completeness  risk  to  an  acceptable  level.  We  then  researched  Acuity’s  FY  2008 
and  FY  2009  TeamMate  validation  files  to  detennine  whether  either  of  these  files 
contained  source  documentation  for  the  assets.  The  validation  TeamMate  files 
were  replicated  versions  that  only  contained  activated  FBWT  related  workpapers, 
that  is,  all  of  the  workpapers  related  to  PP&E  were  inaccessible  in  the  TeamMate 
files  given  to  the  DoD  OIG. 

On  August  30,  2012,  Acuity  provided  additional  supplemental  summary 
workpapers,  dated  August  29,  2012,  that  pertained  to  the  FY  2011  audit.  The 
Managing  Partner,  Acuity  stated  that  it  did  not  appear  that  this  infonnation  was 
considered  in  our  draft  report.  However,  on  page  1 1  through  12  of  our  draft 
report,  we  discuss  our  review  of  Acuity’s  alternative  procedures,  and  although  not 
explicitly  stated,  Acuity’s  supplemental  summary  workpapers  were  included  in 
our  review. 


Acuity’s  Comments  on  DISA’s  Financial  Statement  Footnote 
Disclosures 

The  Managing  Partner,  Acuity  stated  that  the  financial  statement  accompanied  by  the 
auditor’s  report  for  FY  2011  could  have  included  more  complete  disclosures  for  PP&E. 
The  Managing  Partner,  Acuity  quoted  AU  Section  561  regarding  allowance  for  revisions 
to  issued  financial  statements.  The  Managing  Partner,  Acuity  also  stated  they  ensured 
that  DISA  made  the  appropriate  corrections  and  revisions  to  the  note  disclosures  to  the 
FY  2012  comparative  financial  statements  and  they  included  an  explanatory  paragraph  in 
the  audit  report,  which  was  issued  November  15,  2012.  The  Managing  Partner,  Acuity 
further  stated  that  as  of  August  30,  2012,  when  they  discussed  these  concerns  with  the 
DoD  OIG,  there  was  no  need  to  reissue  the  FY  2011  audited  financial  report  because  the 
issuance  of  the  audited  financial  report  for  FY  2012  was  imminent. 
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Our  Response 

It  is  our  opinion  that  Acuity  inappropriately  applied  the  standards  set  forth  in  AU  section 
561.06(b),  Subsequent  Discovery  of  Facts  Existing  at  Date  of  Report,  because  Acuity 
was  aware  of  the  issues  surrounding  DISA’s  financial  statements  well  before  the  FY 
2012  report  becoming  imminent.  We  discuss  this  topic  in  more  detail  in  the  “Our 
Response”  section  of  “Acuity’s  Comments  on  Reissuance  of  Auditor’s  Report.”  We 
maintain,  however,  that  Acuity  should  have  applied  AU  Section  561.06(a)  and  had  the 
FY  2011  financial  statements  and  accompanying  auditor’s  report  re-issued. 

GAGAS  paragraph  3.60  states  that  auditors  must  use  professional  judgment  in 
perfonning  audits  and  in  reporting  the  results.  Although  Acuity  ensured  disclosures  were 
made  in  the  FY  2012  financial  statement  and  auditor’s  report,  it  did  not  provide  a 
response  as  to  why  it  did  not  follow  AU  Section  561.06(a),  since  it  knew  of  this  issue 
long  before  the  imminent  issuance  of  the  FY2012  financial  statements  and  accompanying 
auditor’s  report. 

AU  Section  700.17  states,  “The  auditor's  evaluation  about  whether  the  financial 
statements  achieve  fair  presentation  should  also  include  consideration  of  the  following: 
Whether  the  financial  statements,  including  the  related  notes,  represent  the  underlying 
transactions  and  events  in  a  manner  that  achieves  fair  presentation.”  Additionally,  AU 
Section  508.10  “Reports  on  Audited  Financial  Statements”  requires  the  auditor  to  add  an 
explanatory  language  paragraph  to  the  auditor’s  standard  report  for  when  a  designated 
accounting  standard  setter  requires  information  to  accompany  an  entity’s  basic  financial 
statements.  The  fact  that  Acuity  did  not  disclose  this  issue  in  the  year  the  situation 
existed  and  the  fact  that  they  did  not  provide  an  explanation  of  their  decision  of  why  the 
footnote  disclosures  were  not  necessary,  calls  into  question  Acuity’s  use  of  professional 
judgment  in  reporting  of  the  results  and  ultimately  the  reliability  of  their  audit  opinion  on 
the  FY  2011  financial  statements.  Therefore,  Acuity  did  not  comply  with  the  standards 
set  forth  in  AU  Section  508,  AU  Section  561.06(a),  AU  Section  700.17,  GAGAS3.32  and 
GAGAS  3.60. 


Acuity’s  Comments  on  DISA’s  Informative  Disclosures 

The  Managing  Partner,  Acuity  stated  that  DoD  Financial  Management  Regulation  is  not 
relevant  as  a  standard  in  discussing  the  financial  statement  audit  conducted  by  Acuity  and 
is  neither  a  part  of  the  U.S.  Generally  Accepted  Accounting  Principles  hierarchy  or 
professional  auditing  standards.  The  Managing  Partner,  Acuity  stated  that  the  financial 
statement  accompanied  by  the  auditor’s  report  for  FY  2011  could  have  included  more 
complete  disclosures  for  PP&E.  The  Audit  Partner,  Acuity  quoted  AU  561  regarding 
allowance  for  revisions  to  issued  financial  statements.  The  Audit  Partner,  Acuity  also 
stated  they  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the  note 
disclosures  to  the  FY  2012  comparative  financial  statements  and  they  included  an 
explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15,  2012.  The 
Audit  Partner,  Acuity  stated  that  as  of  August  30,  2012,  when  they  discussed  these 
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concerns  with  the  DoD  OIG,  there  was  no  need  to  reissue  the  FY  2011  audited  financial 
report  because  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent. 

Our  Response 

The  Federal  Accounting  Standards  Advisory  Board  hierarchy  of  accounting  principles 
and  standards  are  used  to  promulgate  DoD  accounting  and  financial  reporting  policy 
within  the  DoD  FMR.  While  it  is  true  that  the  DoD  FMR  is  not  a  standard  for  auditors, 
Acuity  should  have  been  aware  of  the  responsibility  of  DISA  to  prepare  its  financial 
statements  in  accordance  with  the  DoD  FMR.  Additionally,  the  GAO/PCIE  FAM  245 
requires  auditors  to  design  relevant  compliance  related  audit  procedures  to  identify  the 
significant  provisions  of  the  laws  and  regulations. 

The  DoD  FMR  directs  statutory  and  regulatory  financial  management  requirements  for 
working  capital  fund  activities  of  the  DoD.  DISA  is  required  to  present  financial 
information  that  not  only  complies  with  Generally  Accepted  Accounting  Principles,  but 
also  complies  with  the  requirements  of  the  DoD  FMR.  Because  the  grouped  asset  cost 
method  and  the  activation  and  depreciation  method  deviates  from  the  policy  for  recording 
PP&E  in  the  DoD  FMR,  DISA  was  required  to  provide  explanatory  language  about  its 
method  in  the  notes  to  the  financial  statements  or  the  Management’s  Discussion  and 
Analysis  section  of  the  financial  statements.  Because  DISA  did  not  disclose  this 
information,  the  FY  2011  financial  statements  did  not  comply  with  the  Office  of 
Management  and  Budget  CircularA-136,  2010  revision,  section  II.4.9.1  and  the  Chief 
Financial  Officer’s  Act  of  1990,  31  U.S.C.  Section  902  as  required  by  law.  Furthermore, 
AU  Section  508.10,  “Reports  on  Audited  Financial  Statements”  requires  the  auditor  to 
add  an  explanatory  language  paragraph  to  the  auditor’s  standard  report  when  a  designated 
accounting  standard  setter  requires  information  to  accompany  an  entity’s  basic  financial 
statements. 

It  is  our  opinion  that  Acuity  inappropriately  applied  the  standards  set  forth  in  AU  section 
561,  Subsequent  Discovery  of  Facts  Existing  at  the  Date  of  Report,  because  Acuity  was 
aware  of  the  issues  surrounding  DISA’s  financial  statements  prior  to  FY  2012  report 
becoming  imminent.  We  discuss  this  topic  in  more  detail  in  the  “Our  Response”  section 
of  “Acuity’s  Comments  on  Reissuance  of  Auditor’s  Report.” 


Acuity’s  Comments  on  DISA  Not  Disclosing  the  Grouped  Asset 
Cost  Method 

The  Managing  Partner,  Acuity  stated  that  the  financial  statement  accompanied  by  the 
auditor’s  report  for  FY  2011  could  have  included  more  complete  disclosures  for 
PP&E.  The  Managing  Partner,  Acuity  quoted  AU  Section  561  regarding  the  allowance 
for  subsequent  disclosures  to  issued  financial  statements.  The  Managing  Partner,  Acuity 
also  stated  that  they  ensured  DISA  made  the  appropriate  corrections  and  revisions  to  the 
note  disclosures  to  the  FY  2012  comparative  financial  statements  and  they  included  an 
explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15,  2012.  The 
Managing  Partner,  Acuity  stated  that  as  of  August  30,  2012,  when  they  discussed 
concerns  with  the  DoD  OIG,  no  need  existed  to  reissue  the  FY  2011  audited  financial 
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report  because  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent. 

The  Managing  Partner,  Acuity  also  stated  that  DoD  Financial  Management  Regulation  is 
not  relevant  as  a  standard  in  discussing  the  financial  statement  audit  conducted  by  Acuity 
and  is  neither  a  part  of  the  U.S.  Generally  Accepted  Accounting  Principles  hierarchy  or 
professional  auditing  standards. 

Our  Response 

DISA  did  not  disclose  the  grouped  asset  cost  method  in  FY  2011.  The  DoD  FMR  directs 
statutory  and  regulatory  financial  management  requirements  for  working  capital  fund 
activities  of  the  DoD.  DISA  is  required  to  present  financial  information  that  not  only 
complies  with  Generally  Accepted  Accounting  Principles  but  that  also  complies  with  the 
requirements  of  the  DoD  FMR.  Because  the  grouped  asset  cost  method  deviates  from  the 
policy  for  recording  PP&E  in  the  DoD  FMR,  DISA  was  required  to  provide  explanatory 
language  about  its  method  in  the  notes  to  the  financial  statements  and  or  the 
Management’s  Discussion  and  Analysis  section  of  the  financial  statements.  Because 
DISA  did  not  disclose  this  infonnation,  the  FY  2011  financial  statements  did  not  comply 
with  the  Office  of  Management  and  Budget  Circular  A- 136,  2010  revision,  section 
II. 4. 9.1  and  the  Chief  Financial  Officer’s  Act  of  1990,  31  U.S.C.  Section  902  as  required 
by  law. 

The  Federal  Accounting  Standards  Advisory  Board  hierarchy  of  accounting  principles 
and  standards  are  used  to  promulgate  DoD  accounting  and  financial  reporting  policy 
within  the  DoD  FMR.  While  it  is  true  that  the  DoD  FMR  is  not  a  standard  for  auditors, 
Acuity  should  have  been  aware  of  the  responsibility  of  DISA  to  prepare  its  financial 
statements  in  accordance  with  the  DoD  FMR.  Additionally,  the  GAO/PCIE  FAM  245 
requires  auditors  to  design  relevant  compliance  related  audit  procedures  to  identify  the 
significant  provisions  of  the  laws  and  regulations. 


Acuity’s  Comments  on  DISA  Not  Disclosing  the  Grouped  Asset 
Activation  and  Depreciation  Method 

The  Managing  Partner,  Acuity  stated  that  the  financial  statement  accompanied  by  the 
auditor’s  report  for  FY  2011  could  have  included  more  complete  disclosures  for 
PP&E.  The  Managing  Partner,  Acuity  quoted  AU  Section  561  regarding  the  allowance 
for  subsequent  disclosures  to  issued  financial  statements.  The  Managing  Partner,  Acuity 
also  stated  they  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the 
note  disclosures  to  the  FY  2012  comparative  financial  statements  and  they  included  an 
explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15,  2012.  The 
Managing  Partner,  Acuity  stated  that  as  of  August  30,  2012,  when  Acuity  discussed 
concerns  with  the  DoD  OIG,  no  need  existed  to  reissue  the  FY  2011  audited  financial 
report  because  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent. 
The  Managing  Partner,  Acuity  also  stated  that  DoD  Financial  Management  Regulation  is 
not  relevant  as  a  standard  in  discussing  the  financial  statement  audit  conducted  by  Acuity 
and  is  neither  a  part  of  the  U.S.  Generally  Accepted  Accounting  Principles  hierarchy  or 
professional  auditing  standards. 
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Our  Response 

DISA  did  not  disclose  the  grouped  asset  activation  and  depreciation  method  in  FY  2011. 
The  DoD  FMR  directs  statutory  and  regulatory  financial  management  requirements  for 
working  capital  fund  activities  of  the  DoD.  DISA  is  required  to  present  financial 
information  that  not  only  complies  with  Generally  Accepted  Accounting  Principles  but 
that  also  complies  with  the  requirements  of  the  DoD  FMR.  Because  the  grouped  asset 
activation  and  depreciation  method  deviates  from  the  policy  for  recording  PP&E  in  the 
DoD  FMR,  DISA  was  required  to  provide  explanatory  language  about  its  method  in  the 
notes  to  the  financial  statements  and  or  the  Management’s  Discussion  and  Analysis 
section  of  the  financial  statements.  Because  DISA  did  not  disclose  this  information,  the 
FY  2011  financial  statements  did  not  comply  with  the  Office  of  Management  and  Budget 
Circular  A- 136,  2010  revision,  section  II. 4. 9.1  and  the  Chief  Financial  Officer’s  Act  of 
1990,  3 1  U.S.C.  Section  902  as  required  by  law. 

The  Federal  Accounting  Standards  Advisory  Board  hierarchy  of  accounting  principles 
and  standards  are  used  to  promulgate  DoD  accounting  and  financial  reporting  policy 
within  the  DoD  FMR.  While  true  the  DoD  FMR  is  not  a  standard  for  auditors,  Acuity 
should  have  been  aware  of  the  responsibility  of  DISA  to  prepare  its  financial  statements 
in  accordance  with  the  DoD  FMR.  The  GAO/PCIE  FAM  245  requires  auditors  to  design 
relevant  compliance  related  audit  procedures  to  identify  the  significant  provisions  of  the 
laws  and  regulations. 


Acuity’s  Comments  on  Contracting  Officer’s  Representative’s 
Key  Oversight  Duties 

The  Managing  Partner,  Acuity  stated  the  DoD  OIG  report  is  inaccurate  based  on  the 
following  reasons: 

•  The  COR  reviewed  very  little  of  the  work  performed  and  provided  essentially  no 
feedback  beyond  the  Plan  of  Action  and  Milestones. 

•  The  audit  plan  was  not  a  contract  deliverable,  but  was  provided  to  the  COR  within 
2  months  of  the  request. 

•  The  timing  and  delivery  of  the  audit  plan  was  consistent  with  the  timeline 
presented  in  the  draft  report  and  was  representative  of  typical  audit  planning  for  a 
first-year  audit  of  a  client  of  this  complexity  and  size. 

Our  Response 

We  have  addressed  our  concerns  about  the  contract  oversight  perfonned  by  the  COR  with 
DISA  management.  However,  the  Managing  Partner,  Acuity  stated  that  the  audit  plan 
was  not  a  contract  deliverable  and  was  delivered  within  2  months  of  the  request. 
GAO/PCIE  FAM  section  210,  “Overview  of  the  Planning  Phase”  states  that  the  auditor 
must  adequately  plan  the  audit  work  and  the  auditor  should  develop  effective  and 
efficient  ways  to  obtain  the  sufficient  appropriate  evidence  necessary  to  report  on  the 
federal  entity’s  financial  statements.  The  Managing  Partner,  Acuity  stated  that  the  audit 
plan  was  provided  to  the  COR  within  2  months  of  the  request,  yet,  Acuity’s  audit 
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documentation  shows  that  their  draft  audit  plan  is  dated  February  1 1,  201 1.  Additionally, 
the  COR  provided  us  with  the  audit  plan  received  from  Acuity,  also  dated  February  11, 
2011,  which  is  4  months  after  the  contract  was  awarded. 


Acuity’s  Comments  on  Reissuance  of  Auditor’s  Report 

The  Managing  Partner,  Acuity  stated  they  disagree  that  the  audit  report  requires 
reissuance.  The  Managing  Partner,  Acuity  stated  that  the  DoD  OIG’s  application  of  AU 
Section  561,  Subsequent  Discovery  of  Facts,  is  incorrect  and  that  the  correct  standard  to 
apply  first  is  AU  Section  390,  Consideration  of  Omitted  Procedures  After  the  Report 
Date.  The  Managing  Partner,  Acuity  concluded  there  was  no  impairment  to  their  ability 
to  support  and  provide  a  satisfactory  basis  for  their  previously  expressed  opinion,  but  the 
issue  regarding  complete  note  disclosures  for  FBWT  and  PP&E  could  have  affected  the 
FY  2011  report. 

The  Managing  Partner,  Acuity  stated  on  August  30,  2012,  this  information  was  provided 
to  the  DoD  OIG,  but  evidently  was  not  considered  in  developing  their  draft  report.  The 
Managing  Partner,  Acuity  stated  they  ensured  that  DISA  made  the  appropriate 
corrections  and  revisions  to  the  note  disclosures  to  the  FY  2012  comparative  financial 
statements  and  included  an  explanatory  paragraph  in  the  audit  report,  which  was  issued 
November  15,  2012.  In  addition,  the  Managing  Partner,  Acuity  stated  since  this  is  within 
90  days  of  the  issuance  of  the  FY  2012  audited  financial  report,  reissuance  of  the 
FY  2011  financial  audit  report  is  neither  necessary  nor  appropriate. 

Our  Response 

As  identified  in  our  draft  report  on  page  16,  we  discussed  the  application  of  AU  Section 
390,  Consideration  of  Omitted  Procedures,  prior  to  our  discussion  of  AU  Section  561, 
Subsequent  Discovery  of  Facts  Existing  at  Date  of  Report.  AU  Section  390  states, 

“When  the  auditor  concludes  that  an  auditing  procedure  considered  necessary  at  the  time 
of  the  audit  in  the  circumstances  then  existing  was  omitted  from  his  audit  of  financial 
statements,  he  should  assess  the  importance  of  the  omitted  procedures  to  his  present 
ability  to  support  his  previously  expressed  opinion  regarding  those  financial  statements 
taken  as  a  whole.” 

AU  Section  390  further  states,  “When,  as  a  result  of  the  subsequent  application  of  the 
omitted  or  alternative  procedures,  the  auditor  becomes  aware  that  facts  regarding  the 
financial  statements  existed  at  the  date  of  his  report  that  would  have  affected  that  report 
had  he  been  aware  of  them,  he  should  be  guided  by  the  provisions  of 
AU  Section  561.05-.09,  Subsequent  Discovery  of  Facts  Existing  at  the  Date  of  the 
Auditor’s  Report.”  Acuity  was  aware  of  the  issues  surrounding  DISA’s  financial 
statements  we  identified  in  our  report  long  before  imminent  issuance  of  the  FY  2012 
financial  statements  and  accompanying  auditor’s  report.  Therefore,  Acuity’s  application 
of  AU  Section  561.06(b)  does  not  apply  and  AU  Section  561.06(a)  does  apply. 

The  Managing  Partner,  Acuity  stated  that  after  review  of  AU  Section  390,  they  concluded 
there  was  no  impairment  to  support  their  expressed  opinion,  but  the  issue  regarding 
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complete  note  disclosures  for  FBWT  and  PP&E  could  have  affected  the  FY  2011  report. 
The  Managing  Partner,  Acuity  stated  they  ensured  that  DISA  made  the  appropriate 
corrections  and  revisions  to  the  note  disclosures  to  the  FY  2012  comparative  financial 
statements  and  included  an  explanatory  paragraph  in  the  audit  report,  which  was  issued 
November  15,  2012.  After  review  of  all  evidence  provided  by  Acuity,  we  concluded  that 
procedures  omitted  by  Acuity  in  performing  the  DISA  FY  2011  financial  statement  audit, 
impairs  its  ability  to  support  its  previously  expressed  opinion  regarding  the  financial 
statements  taken  as  a  whole. 


Acuity’s  Comments  on  DISA  Contract  Required  Acuity 
Compliance  with  Government  Auditing  Standards 

The  Managing  Partner,  Acuity  stated  they  disagree  that  Acuity  did  not  comply  with 
GAGAS.  The  Managing  Partner,  Acuity  stated  they  designed  a  risk  based  audit  approach 
in  accordance  with  audit  standards  including,  AU  318  Perfonning  Audit  Procedures  in 
Response  to  Assessed  Risk;  AU326  Audit  Evidence,  AU  339  Audit  Documentation,  and 
AU  508  Reports  on  Audited  Financial  Statements.  The  Managing  Partner  also  stated  that 
they  obtained  sufficient  and  appropriate  evidence  to  support  their  conclusion  and  provide 
reasonable  bases  for  their  opinion.  The  Managing  Partner,  Acuity  stated  they  considered 
the  effectiveness  of  management’s  responses  and  controls  to  address  the  risks.  The 
Managing  Partner,  Acuity  also  stated  they  appropriately  documented  their  understanding, 
and  their  work  followed  appropriate  standards,  including  GAGAS,  GAO/PCIE  FAM,  and 
AICPA  standards. 

Our  Response 

The  DoD  OIG  has  cited  numerous  examples  throughout  our  report  where  Acuity  did  not 
comply  with  GAGAS.  Specifically,  Acuity  did  not  comply  with  GAGAS,  Paragraph 
4.19(c),  because  they: 

•  did  not  include  the  validation  of  the  CMR  in  its  audit  documentation,  which 
would  have  required  them  to  obtain  and  document  all  of  the  detail  transactions 
supporting  the  summary  amounts  on  the  CMR, 

•  did  not  explicitly  discuss  the  risk,  materiality,  and  impact  of  the  MFRs  on  the 
financial  statements,  and 

•  did  not  provide  supporting  documentation  for  the  $37.7  million  TSEAS  assets 
tested  to  show  how  the  auditor  reached  their  conclusions. 

Acuity  did  not  comply  with  GAGAS  paragraph  4.03  because  they: 

•  only  performed  summary  reconciliations  of  the  FBWT  account  and  did  not 
adequately  test  to  ensure  DISA  was  perfonning  regular  and  recurring  FBWT 
reconciliations  at  the  detailed  level, 

•  accepted  a  response  from  DISA  regarding  the  deficiencies  in  the  undistributed 
accounts,  but  did  not  perform  any  follow  up  work  on  the  account  to  ensure  the 
undistributed  accounts  could  be  supported,  and 
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•  accepted  the  deficiencies  DISA  reported  in  the  MFRs  without  perfonning 
adequate  auditing  procedures  to  determine  if  the  deficiencies  would  have  a 
material  impact  on  the  FBWT  account. 

Acuity  did  not  comply  with  GAGAS  chapter  5.03(c)  because  they  did  not  state  in  their 
auditor’s  report  that  the  DISA  financial  statement  footnote  disclosures  were  inadequate. 
Additionally,  the  FAM  section  290  requires  the  auditor  to  prepare  audit  documentation  in 
sufficient  detail  to  provide  a  clear  understanding  of  the  work  performed  (including  the 
nature,  extent,  and  timing  and  results  of  audit  procedures  performed),  the  audit  evidence 
obtained  and  its  source,  and  the  conclusions  reached. 

AU  Section  326.20  “Procedures  for  Obtaining  Audit  Evidence”  states  that  the  auditor 
should  obtain  audit  evidence  to  draw  reasonable  conclusions  on  which  to  base  the  audit 
opinion  by  perfonning  audit  procedures  to  detect  material  misstatements  at  the  relevant 
assertion  level.  Audit  procedures  perfonned  for  this  purpose  are  referred  to  as 
substantive  procedures  and  include  tests  of  details  of  classes  of  transactions,  account 
balances,  and  disclosures,  and  substantive  analytical  procedures.  The  auditor  must 
perform  risk  assessment  procedures  to  provide  a  satisfactory  basis  for  the  assessment  of 
risks  at  the  financial  statement  and  relevant  assertion  levels.  Risk  assessment  procedures 
by  themselves  do  not  provide  sufficient  appropriate  audit  evidence  on  which  to  base  the 
audit  opinion  and  must  be  supplemented  by  further  audit  procedures  in  the  form  of  tests 
of  controls,  when  relevant  or  necessary  and  substantive  procedures. 


Acuity  did  not  subject  the  FBWT  line  item  to  adequate  auditing  procedures.  Specifically, 
Acuity  did  not  properly  test  the  DISA  FBWT  reconciliations.  AU  Section  326.04  states 
that  the  auditor  should  obtain  audit  evidence  by  testing  the  accounting  records  through 
analysis  and  review,  and  reperfonning  procedures  followed  in  the  financial  reporting 
process  and  reconciling  related  types  of  the  same  information.  Additionally,  AU  Section 
326.06,  “Sufficient  Appropriate  Audit  Evidence”  states  that  audit  evidence  is  more 
reliable  when  it  is  obtained  from  knowledgeable  independent  sources  outside  the  entity 
and  that  corroborating  infonnation  obtained  from  a  source  independent  of  the  entity  may 
increase  the  assurance  the  auditor  obtains  from  management  representations. 

A  proper  FBWT  reconciliation  would  require  that  DISA  retrieve  the  disbursement  and 
collection  transactions  processed  by  the  disbursing  offices  to:  support  the  summary 
amounts  on  the  CMR;  reconcile  the  disbursements  and  collections  supporting  the  CMR  to 
the  disbursements  and  collections  reported  in  the  accounting  system;  and  research,  and  if 
necessary,  resolve  any  variances  between  the  transactions  supporting  the  CMR  and  the 
transactions  in  the  accounting  system.  However,  Acuity  only: 

•  obtained  the  detail  transactions  recorded  in  the  accounting  system  (but  did  not 
obtain  the  detail  transactions  supporting  the  CMR),  and 

•  summed  the  transactions  in  the  accounting  system  and  compared  that  summary 
amount  to  the  summary  amount  supporting  the  CMR 
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Acuity  also  acknowledged  that  it  did  not  include  the  validation  of  the  CMR  in  its  audit 
documentation,  which  would  have  required  it  to  obtain  and  document  all  of  the  detail 
transactions  supporting  the  summary  amounts  on  the  CMR.  Because  Acuity  did  not 
obtain  and  document  the  detail  transactions  supporting  the  summary  amounts  within  the 
CMR,  Acuity  failed  to  adhere  to  the  standards  in  AU  Section  326. 

In  addition  AU  Section  339  “Audit  Documentation”  requires  the  auditor  to  prepare  audit 
documentation  in  connection  with  each  engagement  in  sufficient  detail  to  provide  a  clear 
understanding  of  the  work  perfonned  (including  the  nature,  timing,  extent,  and  results  of 
audit  procedures  performed),  the  audit  evidence  obtained  and  its  source,  and  the 
conclusions  reached. 

Acuity  selected  6  high-dollar  value  assets  valued  at  $37.7  million,  out  of  31  TSEAS 
assets  valued  at  $49.3  million  in  the  PP&E  1790  and  1791  general  ledger  account 
balances.  Of  the  six  assets  tested,  the  auditor  found  no  discrepancies  with  the  samples, 
but  provided  no  supporting  documentation  to  show  how  the  auditor  reached  its 
conclusions.  Therefore,  Acuity  failed  to  adhere  to  the  standards  in  AU  Section  339. 

Additionally,  AU  Section  508.10  “Reports  on  Audited  Financial  Statements”  requires  the 
auditor  to  add  an  explanatory  paragraph  to  the  auditor’s  standard  report  when  a 
designated  accounting  standard  setter  requires  infonnation  to  accompany  the  entity's 
basic  financial  statements,  while  not  affecting  the  auditor’s  unqualified  opinion  on  the 
financial  statements.  Because  Acuity  was  aware  that  DISA  did  not  disclose  the  group 
asset  cost  and  activation  and  depreciation  method  and  did  not  disclose  this  infonnation  in 
an  explanatory  language  paragraph  in  the  report,  Acuity  did  not  comply  with  the 
standards  set  forth  in  AU  section  508. 
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Defense  Information  Systems  Agency  Comments 


DEFENSE  INFORMATION  SYSTEMS  AGENCY 

P  O.  BOX  540 

FORT  MEADE.  MARYLAND  20755  0549 


ncflwTo  Vice  Director  (DV) 


FEB  0  1 2013 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 

SUBJECT:  Defense  Information  Systems  Agency  (DISA)  comments  and  responses  to  the 

Draft  Audit  Opinion  Report  of  the  DISA  FY  201 1  Working  Capital  Fund  Financial 
Statements  Was  Not  Adequately  Supported,  January  8, 2013, 

(Project  No.  D2012FH-0122) 


1.  We  appreciate  the  DoD  IG's  review  and  comments  and  will  use  this  valuable  input  as  we 
seek  to  attain  sustainable  audit  readiness.  The  Agency’s  first  ever  assertion  for  Audit  validated 
many  of  our  processes  and  procedures  while  providing  a  significant  learning  opportunity. 
While  not  perfect,  the  Agency  is  much  better  off  for  having  submitted  for  Audit,  having  now 
developed  greatly  improved  internal  management  controls  and  put  a  process  in  place  for 
continuous  improvement.  This  feedback  is  invaluable  and  will  help  DISA  improve  this  aspect 
of  Agency  internal  controls.  We  have  reviewed  the  draft  report  referenced  above  and  provide 
the  enclosed  comments. 


2.  We  look  forward  to  working  with  you  and  your  staff  in  the  future.  Any  questions  your  staff 
may  have  concerning  matters  for  the  recommendations  should  be  directed  loH~Tl 


Enclosure  a/s  DAVID  G.  SIMPSON 

Rear  Admiral,  USN 
Vice  Director 
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Defense  Information  Systems  Agency  (DISA)  responses  to  the 
Draft  Audit  Opinion  Report  on  the  DISA  FY  201 1  Working  Capital  Fund  Financial 
Statements  Was  Not  Adequately  Supported,  dated  January  8, 2013, 

(Project  No.  D2012-DOOOFH-0122.000) 


PREFACE: 

Your  review  has  illuminated  the  importance  of  clear  delineation  of  roles  and 
responsibilities  in  the  management  of  the  IPA  contract  and  best  practices  in  writing 
effective  IPA  audit  services  contract  language.  DISA’s  review  of  the  actions  of  the 
Director,  PLD  found  that  the  COR  and  PLD  Director  strictly  interpreted  their  individual 
responsibilities  in  the  execution  of  the  IPA  contract  effort  with  the  COR  focusing  on  the 
auditing  standards  and  the  PLD  Director  focusing  on  the  stated  deliverables.  In  future 
audits,  as  evidenced  by  the  FY2012  audit  contract,  DISA  will  ensure  appropriate 
language  is  incorporated  into  contract  deliverables.  We  will  be  interested  in  DoD  IG’s 
assessment  of  the  FY12  audit  to  determine  if  adjustments  made  were  sufficient. 


DISA  COMMENTS  TO  RECOMMENDATIONS: 

RECOMMENDATION  l.a:  The  Director,  DISA  should  review  the  actions  of  the 
Director,  Procurement  and  Logistics  Directorate  to  determine  whether  they  acted  within 
the  scope  of  their  authority  and  take  appropriate  corrective  action  as  necessary. 

DISA  RESPONSE:  Concur 

We  are  reviewing  the  actions  of  the  Procurement  and  Logistics  Directorate  (PLD). 

Please  note  that  the  Director,  PLD  has  been  designated  as  the  Head  of  Contracting 
Activity  (HCA)  for  DISA  and  has  been  delegated  all  procurement  authorities  of  the 
Director  of  DISA,  including  authority  to  enter  into  and  administer  contracts.  As  required 
by  the  Federal  Acquisition  Regulations,  including  the  DoD  Supplement,  the  Contracting 
Officer's  Representative  (COR)  was  designated  and  authorized  by  the  contracting  officer 
(see  FAR  1.602-2,  DFARS  201.602-2,  and  DFARS  PGI  201.602-2).  The  contracting 
officer  has  the  responsibility  to  specify  the  duties  of  the  COR  and  has  the  authority  to 
adjust  those  duties  as  needed.  Adjustment  of  the  COR’s  duties  is  within  the  scope  of  the 
authority  of  the  contracting  officer,  thus  corrective  action  on  the  issue  of  authority  is  not 
necessary. 

Estimated  Completion  Date:  February  1,2013 


RECOMMENDATION  l.b:  Ensure  that  the  responsibilities  of  individuals  performing 
contract  oversight  of  financial  statement  audits  are  fulfilled  by  a  qualified,  General 
Schedule  05 1 1  series  Defense  Information  Systems  Agency  employee. 
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DISA  RESPONSE:  Concur. 

Concur  that  the  individuals  performing  contract  oversight  of  financial  statement  audits 
will  be  fulfilled  by  qualified  DISA  employees.  We  will  use  employees,  including 
General  Schedule  05 1 1  employees  and  other  qualified  employees,  dependi  ng  on  the 
duties  that  need  to  be  performed.  We  currently  have  seven  GS  05 1 1  personnel  assigned 
to  the  Agency  that  would  be  available  for  COR  duties. 

Estimated  Completion  Date:  February  1, 2013 


RECOMMENDATION  I.c:  Seek  a  refund  from  Acuity  Consulting,  Inc.  for  the  audit 
services  not  provided  on  the  Defense  Information  Systems  Agency  FY  201 1  Working 
Capital  Fund  Financial  Statements  contract. 

DISA  RESPONSE: 

DISA  believed  throughout  execution  of  the  auditing  service  contract  effort  that  the  IPA 
was  fulfilling  its  legal  contract  requirements.  DISA  continues  to  review  this  matter.  The 
review  will  include  the  contract  documentation,  the  DoD  IG  audit  work  papers,  and  any 
response  to  this  audit  by  the  contractor  to  determine  if  there  is  a  basis  to  assert  that  the 
provisions  of  the  contract  were  not  complied  with.  As  part  of  this  review,  DISA  will 
have  to  determine  whether  there  is  a  basis  to  seek  a  refund  given  that  performance  of  the 
contract  is  complete.  If  DISA  determines  that  there  is  reason  to  seek  a  refund,  we  will 
need  the  support  of  the  Department  in  pursuing  that  remedy. 

Estimated  Completion  Date:  March  31, 2013 
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Acuity  Consulting,  Inc.  Comments 


Douglas  &  boy  ki  n  .-u* 


February  8, 2013 


By  Courier  &  Email 


Office  of  the  Inspector  General 
Department  of  Defense 
4800  Mark  Center  Drive 
Alexandria,  VA  22350 


Re:  The  Audit  Opinion  of  Ihe  DISA  FY  2011  Working  Capital  Fund  Financial 

Statements  Was  Not  Adequately  Supported  (Project  No.  020 1 2-DOOOF FI- 

0122.  000) 


Pearl 


This  letter  transmits  Acuity’s  comments  to  the  Office’s  findings  and  recommendations  in 
the  referenced  report.  The  Office  recommends  that  Acuity  withdraw  its  unqualified  opinion  of 
the  Defense  Information  Systems  Agency  FY  201 1  Working  Capital  Fund  Financial  Statements. 
(Recommendation  2.a.)  Acuity  docs  not  believe  it  is  necessary  to  withdraw  its  opinion  because 
based  on  the  procedures  performed,  the  risk  of  material  misstatement  is  low. 

Acuity’s  position  is  explained  fully  in  the  enclosed  comments  prepared  and  executed  by 
Acuity.  The  comments  are  also  supplemented  by  the  enclosed  DVD  of  DISA  FY2011 
workpapers  that  explicate  the  referenced  material.  The  DVD  is  provided  to  ensure  the  DoDIG 
has  the  latest  version  of  the  workpapers  which  includes  any  revisions  made  as  a  result  of 
Acuity’s  quality  review  process.  Any  changes  made  did  not  impact  the  substance  of  any  audit 
workpapers  with  the  exception  of  workpaper  4000C.  1 0  related  to  the  trend  analysis  of  the  FBWT 
undistributed  reconciliation,  inadvertently  omitted  from  the  original  workpapers. 

The  Office  also  recommends  that  Acuity  review  its  planned  work  on  future  audits  and 
incorporate  the  appropriate  audit  steps  into  its  audit  plan  to  gather  sufficient  evidence  to  support 
its  opinion.  (Recommendation  2.b.)  Acuity  is  mindful  of  the  importance  of  each  plan  being 
designed  to  meet  the  real-world  issues  of  an  audit.  Where  the  purpose  of  the  audit  is,  for 
example,  to  verify  the  factual  existence  of  objects,  then  it  may  be  appropriate  to  verify  all 
external  sources.  When,  as  here,  the  purpose  is  to  design  a  risk  based  approach  then  it  is 
appropriate  to  exercise  professional  judgment  as  to  what  constitutes  sufficient  appropriate  audit 
evidence  by  considering  factors  such  as  the  significance  of  the  potential  misstatement  in  the 
relevant  assertion  and  the  likelihood  of  its  having  a  material  effect,  individually  or  aggregated 
with  other  potential  misstatements,  on  the  financial  statements.  Acuity  considered  other  factors 
in  its  audit  approach  including: 
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DOUCL  AScgTBOYKI  IN  ... 


Office  of  the  Inspector  General 

Re:  The  Audit  Opinion  of  the  DISA  FY  201 1  Working  Capital  Fund  Financial  Statements  Was  Not 
Adequately  Supported  (Project  No.  D2O12-D0OOF 11-0 122. 000) 

February  8, 2013 
Page  2  of  2 


•  the  effectiveness  of  management's  responses  and  controls  to  address  the  risks; 

•  the  experience  it  has  gained  during  previous  audits  (which,  as  a  matter  of  course. 
Acuity  uses  to  continuously  improve  its  audit  documentation);  and 

•  their  understanding  of  DISA  and  its  environment  of  internal  controls,  the  source 
and  reliability  of  available  information;  and  the  persuasiveness  of  audit  evidence. 


Acuity’s  audit  plan  was  appropriate  given  the  purpose  of  the  audit.  Acuity  designed  its 
risk-based  approach  in  accordance  with  audit  standards  (to  wit.  AU§318,  Performing  Audit 
Procedures  in  Response  to  Assessed  Risk;  AU§326,  Audit  Evidence ;  AU§339,  Audit 
Documentation;  and  AU§508,  Reports  on  Audited  Financial  Statements j.  Further,  execution  of 
the  audit  plan  enabled  Acuity  to  obtain  sufficient  evidence  to  support  its  conclusions  and  provide 
a  reasoned  basis  for  its  opinion.  As  is  fully  explained  in  the  enclosed  comments  and  clarifying 
information.  Acuity  met  the  applicable  auditing  standards.  Accordingly,  Acuity  respectfully 
disagrees  with  the  OIG's  conclusion  that  it  should  withdraw  its  unqualified  opinion. 


Enclosures:  (2)  (Acuity  Comments;  accompanying  DVD  transmitted  only  with  hard  copy  letter,  not  email). 


Cc: 


|,  Acuity 
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ACUITY  COMMENTS 

The  Audit  Opinion  of  the  DISA  FY  201 1,  Working  Capital  Fund  Financial  Statements 
Was  Not  Adequately  Supported,  Project  Mo.  D201 2-DtWOFH-0 1 22. 000 

OVERALL  COMMENTS 

Acuity  designed  a  risk-based  approach  to  its  audit  of  the  DISA  FY  201 1  Working  Capital  Fund 
Financial  Statements  in  accordance  with  audit  standards  including:  AU§3 1 8,  Performing  Audit 
Procedures  in  Response  to  Assessed  Risk ;  AU§326,  Audit  Evidence ;  AU§339,  Audit 
Documentation ;  and  AU§508,  Reports  on  Audited  Financial  Statements.  Wc  obtained  sufficient 
and  appropriate  audit  evidence  to  support  our  conclusions  and  provide  a  reasonable  basis  for  our 
opinion.  Our  professional  judgment  as  to  what  constituted  sufficient  appropriate  audit  evidence 
was  influenced  by  factors  such  as  the  significance  of  the  potential  misstatement  in  the  relevant 
assertion  and  the  likelihood  of  its  having  a  material  effect,  individually  or  aggregated  with  other 
potential  misstatements,  on  the  financial  statements.  Additionally,  wc  considered:  the 
effectiveness  of  management’s  responses  and  controls  to  address  the  risks;  the  experience  we 
gained  during  previous  audits;  our  understanding  of  DISA  and  its  environment,  including  its 
internal  controls;  the  source  and  reliability  of  available  information;  and  the  persuasiveness  of 
the  audit  evidence. 

The  Department  of  Defense  (DoD)  Office  of  the  Inspector  General  (DoDIG)  report  contained 
misstatements  about  and  mischaracterizations  of  our  audit  work  and,  in  some  instances, 
presented  information  incorrectly  or  out  of  context.  In  addition,  the  DoDIG  did  not  consider  all 
relevant  information  Acuity  provided  to  help  the  DoDIG  understand  Acuity’s  audit  approach  and 
procedures.  We  respectfully  request  that  DoDIG  reconsider  its  position  stated  in  the  draft  report. 

FINDING:  ACUITY’S  AUDITING  PROCEDURES  TO  SUPPORT  THEIR 
OPINION  ON  THE  DISA  FY  2011  WORKING  CAPITAL  FUND 
FINANCIAL  STATEMENTS  WERE  NOT  EFFECTIVE 

DoDIG  Report:  Acuity  did  not  have  sufficient  evidence  to  issue  an  unqualified  opinion  on  the 
DISA  FY  201 1  WCF  Financial  Statements.  Furthermore,  without  performing  procedures  that 
ensure  compliance  with  GAGAS.  FAM.  and  AICPA  standards,  the  DoD  does  not  have  assurance 
that  the  DISA  FY  201 1  Financial  Statements  are  free  of  material  misstatements. 

Acuity  Response:  Per  AU§318,  AU§326,  AU§339,  and  AU§508,  Acuity  considered  the  risk  of 
material  misstatement  associated  with  each  material  assertion,  account,  or  class  of  transactions 
and  obtained  sufficient  and  appropriate  evidence  to  reduce  the  risk  of  material  misstatement  to  an 
acceptable  level.  In  our  professional  judgment,  we  had  sufficient  and  appropriate  evidence  to 
provide  a  reasonable  basis  for  an  unqualified  opinion  on  the  DISA  FY  201 1  WCF  Financial 
Statements.  Our  audit  was  designed  and  conducted  in  accordance  with  AICPA  standards, 

GAGAS,  and  the  GAO/PCIE  Financial  Audit  Manual. 

Acuity  respectfully  disagrees  with  the  DoDIG’s  position  because  the  procedures  performed 
complied  with  GAGAS,  FAM,  and  AICPA  standards. 
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ECD:  N/A. 

Acuity  Did  Not  Perform  Sufficient  Audit  Procedures  to  Support  Their 
Audit  Opinion 

DoDIG  Report:  Acuity  did  not  perform  key  audit  procedures  to  support  the  audit  opinion  on  the 
D/S  A  FY  201 1  WCF  Financial  Statements.  Specifically,  Acuity 's  procedures  used  to  test  the 
DISA  FBWT  account  and  PP&E  line  item  were  inadequate. 

Acuity  Response:  Acuity  respectfully  disagrees  with  the  DoDIG’s  position  because  the 
procedures  performed  complied  with  GAGAS,  FAM,  and  AICPA  standards.  Per  AU§3 1 8, 

AU§326,  AU§339,  and  AU§508,  Acuity  considered  the  risk  of  material  misstatement  associated 
with  each  material  assertion,  account,  or  class  of  transactions  and  obtained  sufficient  and 
appropriate  evidence  to  reduce  the  risk  of  material  misstatement  to  an  acceptable  level.  In  our 
professional  judgment,  we  had  sufficient  and  appropriate  evidence  to  provide  a  reasonable  basis 
for  an  unqualified  opinion  on  the  DISA  FY  201 1  WCF  Financial  Statements.  Our  audit  was 
designed  and  conducted  in  accordance  with  AICPA  standards,  GAGAS,  and  the  GAO/PCIE 
Financial  Audit  Manual.  For  details  related  to  FBWT  and  PP&E,  see  the  specific  comments 
written  below. 

ECD:  N/A. 

Acuity’s  Procedures  for  Auditing  the  DISA  FBWT  Account  Were 
Inadequate 

DoDIG  Report:  Acuity  did  not  perform  adequate  auditing  procedures  on  the  FB  WT  account. 

Acuity  Response:  See  details  in  the  following  subsections. 

ECD:  N/A. 

Acuity  Did  Not  Properly  Test  DISA  FBWT  Reconciliations 

DoDIG  Report:  Acuity ‘s  procedures  for  auditing  the  DISA  FBWT  reconciliations  were 
inadequate. 

Acuity  Response:  The  report  does  not  articulate  why  DoDIG  believes  Acuity’s  FBWT 
reconciliation  testing  procedures  might  result  in  an  unacceptable  risk  of  material  misstatement. 

To  the  extent  DoDIG  is  concerned  about  the  risk  of  material  misstatement  related  to  unrecorded 
collections  and  disbursements,  Acuity’s  audit  approach  controlled  this  risk  to  an  acceptable  level. 
Acuity  performed  a  risk-based  and  standards-based  audit  approach  in  accordance  with  AU§318, 
AU§326,  and  AU§339.  We  employed  a  variety  of  complementary  procedures  and  independently 
validated  the  FBWT  reconciliations.  We  performed  substantive  audit  procedures  related  to  the 
financial  statement  reporting  process  by:  reconciling  the  financial  statements  (in  this  case,  the 
FBWT  trial  balances,  as  the  balance  sheet  reports  SO  for  FBWT)  to  the  underlying  accounting 
records  (/.«.,  accounting  system  subsidiary  ledgers  for  disbursements  and  collections);  examining 
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material  journal  entries  and  other  adjustments  related  to  FBWT;  relying  upon  our  experience 
gained  in  previous  audits  and  our  historical  experience  with  DISA  (e.g.  examining  and/or 
auditing  four  years  of  their  financial  records);  and  considering  the  source  and  reliability  of  the 
audit  evidence.  Specifically,  Acuity: 

•  Observed  DISA’s  FBWT  reconciliation  processes  and  reviewed  them. 

•  Performed  an  independent  reconciliation  of  FBWT  and  the  Cash  Management  Report 
(CMR),  including  detailed  substantive  and  internal  control  testing  of  collection  and 
disbursement  transactions. 

•  Performed  a  reconciliation  of  CMR  cash  activity  to  the  AR(M)  1 307  Report  and  Net 
Outlays  on  the  SF  133. 

•  Examined  and  performed  an  independent  reconciliation  of  the  DFAS-lndianapolis 
(DFAS-IN)  SF  133  Reconciliation  to  the  Cash  Balance  at  the  .05  level,  which  was  from  a 
reliable  independent  source. 

o  Confirmed  the  summary  collection  and  disbursement  amounts  reported  in  the  DFAS- 
IN  SF  133  Reconciliation  at  the  .05  level  agreed  to  the  accounting  system  subsidiary 
ledger  collection  and  disbursement  transactions, 
o  Performed  complementary  substantive  and  internal  control  testing  (including  various 
analytical  procedures)  of  collections  and  disbursement  detail  transactions  in 
conjunction  with  the  revenue  and  expense  cycle  audit  procedures.  We  tested  a 
significant  number  of  detailed  collection  and  disbursement  transactions  during  both 
interim  and  year-end  testing,  which  identified  no  significant  control  weaknesses  or 
discrepancies  regarding  the  completeness  of  collection  and  disbursement  transactions. 
Also,  we  performed  cut-off  testing  of  collections  and  disbursements  at  year-end  in 
conjunction  with  our  revenue  and  expense  cycle  audit  procedures,  which  provided  a 
reasonable  basis  to  conclude  a  lower  risk  of  material  misstatement  related  to  missing 
or  incomplete  collection  and  disbursement  transactions. 

•  Reconciled  the  ending  Defense  Working  Capital  Fund  (DWCF)  FBWT  balance  to  the 
balance  reported  on  the  GWA,  another  reliable  independent  source  (i.e.,  U.S.  Department 
of  Treasury). 

To  address  the  DoDIG’s  questions  and  clarify  points  apparently  misunderstood,  we  prepared 
supplemental  summary  workpapers  subsequent  to  the  audit  to  more  clearly  document  the  work 
performed  and  tie  related  work  together  to  facilitate  a  review  by  an  independent  reviewer.  On 
August  30,  2012,  we  provided  these  workpapers  to  the  DoDIG.  We  respectfully  request  that  the 
DoDIG  consider  these  supplemental  workpapers  in  its  present  review  and  update  the  draft  report 
to  reflect  consideration  of  these  documents  Acuity  provided  to  further  clarify  our  audit  approach 
for  the  DoDIG. 

Acuity’s  audit  approach,  which  included  detailed  internal  control  and  substantive  testing  of 
collection  and  disbursement  transactions  and  corroborating  audit  evidence  from  independent 
sources,  provides  a  reasonable  basis  to  manage  the  risk  of  material  misstatement  related  to 
unrecorded  collection  and  disbursement  transactions. 
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In  summary.  Acuity  respectfully  disagrees  the  work  was  inadequate.  The  procedures  performed 
complied  with  GAGAS,  FAM,  and  AICPA  standards. 

WP  References:  4000C.  1 0;  5000F.  1 5 A.  1 ;  5000F.  1 5 A.2 

ECD:  N/A. 

Acuity  Did  Not  Determine  Whether  the  Undistributed  Accounts  Were  Free 
of  Material  Misstatement 

DoDIG  Report:  Acuity  did  not  determine  whether  the  TSEAS  and  Computer  Services 
Directorate  (CSD)  ‘'Undistributed  Disbursements  "  accounts  were  free  of  material 
misstatements.  Acuity  determined  that  the  balances  in  the  TSEAS  undistributed  account,  totaling 
SI 5.3  million  and  the  CSD  undistributed  account,  totaling  $929  thousand,  were  both  above  the 
allocated  materiality  threshold  for  the  FBWT  account.  However,  Acuity  did  not  adequately 
follow  up  on  the  identified  deficiencies. 

Acuity  Response:  The  report  does  not  specifically  articulate  why  DoDIG  believes  Acuity’s 
procedures  might  result  in  an  unacceptable  risk  of  material  misstatement.  To  the  extent  DoDIG 
is  concerned  about  the  risk  of  material  misstatement  related  to  improper  or  incorrect 
disbursements.  Acuity  controlled  this  risk  to  an  acceptable  level.  Acuity  performed  a  risk-based 
and  standards-based  audit  approach  in  accordance  with  AU§318,  AU§326,  and  AU§339.  We 
employed  a  variety  of  complementary  substantive  audit  procedures  throughout  the  audit  related 
to  the  financial  statement  reporting  process  by:  agreeing  the  accounts  payable  financial 
statement  line  item  to  the  underlying  accounting  records  (i'.e.,  accounting  system  subsidiary 
ledgers  for  accounts  payable  undistributed  disbursements);  examining  material  journal  entries 
and  other  adjustments  related  to  accounts  payable  undistributed  disbursements;  and  relying  upon 
our  experience  gained  in  other  DoD  audits  and  our  historical  experience  with  DISA  (e.g., 
examining  and/or  auditing  four  years  of  accounts  payable  undistributed  disbursements).  We  also 
considered  the  effectiveness  of  management’s  responses  and  controls  to  address  the  risks  as  they 
matured  their  processes  and  procedures  based  upon  Acuity’s  previously  issued  notifications  of 
findings.  Specifically,  Acuity: 

•  Performed  interim  tests  of  the  accounts  payable  undistributed  accounts  as  part  of  baseline 
testing  and  throughout  the  year,  including  Q2  (CSD),  Q3  (CSD  and  TSEAS),  and  Q4 
(CSD  and  TSEAS),  which  identified  DISA’s  continuous  improvement  in  analyzing  and 
understanding  the  nature  of  the  transactions  in  this  account  and  the  resulting  ability  to 
reduce  the  volume  of  transactions  and  value  of  accounts  payable  undistributed 
disbursements. 

•  Performed  audit  procedures  that  provided  sufficient  and  appropriate  evidence  to  provide 
a  reasonable  basis  for  the  conclusion  regarding  accounts  payable  undistributed 
disbursements. 

We  performed  an  audit  procedure  to  analyze  the  accounts  payable  undistributed  disbursement 
transaction  activity  in  October  201 1,  comparing  to  the  transactions  comprising  the  reported 
balance  on  September  30, 2011,  and  determined  the  related  transactions  had  cleared  through  the 
normal  process.  The  audit  procedure  was  performed  subsequent  to  the  issuance  of  our  report  in 
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accordance  with  AU§390,  Consideration  of  Omitted  Procedures  Al  ter  the  Report  Date, 
concluding  the  risk  of  material  misstatement  related  to  accounts  payable  undistributed 
disbursements  was  minimal.  We  documented  this  in  the  workpapers  and  on  August  30,  2012, 
provided  them  to  the  DoDIG. 

It  appears  the  DoDIG  did  not  consider  the  results  of  the  subsequently  performed  procedure  or 
our  conclusion  there  was  no  risk  of  material  misstatement.  Since  the  risk  of  material 
misstatement  was  low,  the  omitted  procedure  had  no  impact  on  our  previously  issued  unqualified 
opinion.  We  respectfully  request  that  the  DoDIG  consider  these  supplemental  workpapers  in  its 
present  review  and  update  the  draft  report  to  reflect  consideration  of  these  documents  Acuity 
provided  to  further  clarity  our  audit  approach  for  the  DoDIG. 

Acuity’s  audit  approach — which  included  consideration  of  DISA’s  responsiveness  to  concerns 
we  identified  in  their  accounts  payable  undistributed  disbursements;  and  the  internal  control  and 
substantive  audit  procedures  performed  during  interim,  year-end,  and  subsequent  to  the  audit 
report  date — provides  a  reasonable  basis  to  manage  the  risk  of  material  misstatement  related  to 
improper  or  incorrect  accounts  payable  undistributed  disbursement  transactions. 

Therefore,  Acuity  respectfully  disagrees  with  DoDIG’s  conclusion  that  Acuity  did  not 
adequately  follow  up  on  the  identified  deficiencies. 

WP  References:  2500.03a.  I 

ECD:  N/A. 

Acuity  Did  Not  Address  Material  Audit  Trail  Deficiencies 

DoDIG  Report:  Acuity  did  not  adequately  assess  whether  the  deficiencies  identified  by  DISA  in 
its  FBWT  MFRs  would  have  a  material  impact  on  the  financial  statements  and  ultimately 
Acuity 's  opinion. 

Acuity  Response:  The  report  does  not  specifically  articulate  why  DoDIG  believes  the  FBWT 
MFR  deficiencies  would  impact  Acuity’s  opinion.  Acuity  controlled  the  risk  of  material 
misstatement  related  to  the  beginning  FBWT  balance  to  an  acceptable  level.  Acuity  performed  a 
risk-based  and  standards-based  audit  approach  in  accordance  with  AU§3 1 8,  AU§326,  AU§339, 
and  AU§342,  Auditing  Accounting  Estimates.  Specifically,  Acuity: 

•  Conducted  a  thorough  review  of  the  documentation  and  data  provided  by  DISA  in 
support  of  the  MFRs,  which  is  documented  in  the  workpapers.  Also,  we  consulted  with 
an  expert  in  the  field  of  FBWT  reconciliations. 

•  Determined  the  risk  of  material  misstatement  was  sufficiently  low  to  provide  a  reasonable 
basis  for  an  unqualified  opinion  based  on  DISA  FBWT  (i.e.,  collection  and  disbursement) 
internal  controls  in  place  since  FY  2007. 

•  Determined  the  FBWT  baseline/MFR  process  was  a  significant  issue  because  it  involved 
complex  transactions  and  there  was  difficulty  in  applying  audit  procedures  due  to  the  lack 
of  documentation.  In  this  situation,  the  original  source  documentation  supporting 
disbursements  and  collections  prior  to  FY  2007  was  no  longer  available.  Because  this 
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occurred  prior  to  the  audit,  we  would  have  had  no  opportunity  to  request  that  DISA 
maintain  this  documentation  for  future  audit.  In  our  professional  judgment,  we  applied 
appropriate  procedures  to  test  the  interna!  controls  on  the  FBWT  reconciliation  process 
and  the  collection  and  disbursement  transactions.  We  relied  upon  our  experience  and 
familiarity  with  DISA  from  examining  and/or  auditing  four  years  of  their  financial 
records.  Further,  we  validated  the  reasonableness  of  DISA’s  baseline  approach 
documented  in  the  MFRs,  which  was  further  corroborated  by  DFAS,  an  independent 
source,  who  participated  in  documenting  the  baseline  and  audit  trail  in  the  MFR  process. 

•  Evaluated  the  reasonableness  of  the  estimated  beginning  balances,  concentrating  on  key 
factors  and  assumptions  significant  to  the  accounting  estimates,  such  as  the  cash  rebuild 
adjustments  of  $3.9  million  (net)  for  TSEAS  and  $  1 86.9  million  for  CSD.  Acuity  also 
considered  the  estimated  beginning  balances  and  assumptions  relative  to  the  experiences 
we  had  with  other  DoD  clients  and  specifically  with  DISA  collections  and  disbursements 
for  fiscal  years  2008-201 1.  Further,  we  considered  the  potential  bias  that  may  be 
introduced  by  the  client  by  considering  corroborating  information  from  and  participation 
by  DFAS,  an  independent  source. 

Although  we  fully  assessed  the  MFR  deficiencies,  we  determined  we  did  not  clearly  document 
all  of  our  conclusions.  Accordingly,  we  prepared  supplemental  summary  workpapers,  which 
referenced  and  linked  the  MFR  workpapers  in  the  baseline  section  of  the  FY  201 1  TeamMatc 
project  file,  and  clarified  our  conclusions  with  respect  to  the  MFRs.  On  August  30, 2012,  we 
provided  the  supplemental  summary  workpapers  with  our  fully  documented  conclusions  to  the 
DoDIG,  and  noted  that  workpapers  documenting  the  work  performed  on  the  FBWT  MFR  were 
in  the  FY2010  baseline  procedures  section  of  the  FY  201 1  audit  workpapers.  It  does  not  appear 
this  information  was  considered  in  the  draft  report.  We  respectfully  request  that  the  DoDIG 
consider  these  supplemental  workpapers  in  its  present  review  and  update  the  draft  report  to 
reflect  consideration  of  these  documents  Acuity  provided  to  further  clarify  our  audit  approach  for 
the  DoDIG. 

The  financial  statements  accompanied  by  the  auditor’s  report  for  FY  201 1  could  have  included 
an  explanatory  paragraph  of  emphasis  and  more  complete  disclosures  for  FBWT.  AU§561 .06.a. 
allows  for  revision  of  only  the  most  recently  issued  financial  report,  while  AU§561.06.b.  states 
that  “when  issuance  of  financial  statements  accompanied  by  the  auditor’s  report  for  a  subsequent 
period  is  imminent ...  appropriate  disclosure  of  the  revision  can  be  made  ...  instead  of  reissuing 
the  earlier  statements.”  Acuity  ensured  that  DISA  made  the  appropriate  corrections  and 
revisions  to  the  note  disclosures  to  the  FY  2012  comparative  financial  statements  and  we 
included  an  explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15, 2012. 
Accordingly,  Acuity  does  not  believe  reissuance  of  the  FY  201 1  audited  financial  report  is 
warranted. 

WP  References:  2400.50 
ECD:  N/A. 
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Acuity’s  Reliance  on  DISA  Management 

DoDIG  Report:  Acuity  relied  on  representations  from  management  and  did  not  independently 
validate  the  representations  made  by  DISA. 

Acuilv  Response:  AU§220,  Independence,  states  the  “auditor  must  maintain  independence  in 
mental  attitude  in  all  matters  relating  to  the  audit.”  AU§230,  Due  Professional  Care  in  the 
Performance  of  Work,  requires  the  auditor  to  exercise  professional  skepticism.  Acuity  was 
unbiased  with  respect  to  DISA  management’s  representations  and  exercised  professional 
skepticism.  Further,  we  assessed  risk  and  performed  a  risk-based  and  standards-based  audit 
approach  in  accordance  with  AU§3 1 8,  AU§326,  and  AU§339.  Acuity  independently  reviewed 
and  observed  DISA  reconciliations  and  other  procedures. 

To  address  the  DoDIG’s  questions  and  clarify  points  apparently  misunderstood,  we  prepared 
supplemental  summary  workpapers  subsequent  to  die  audit  to  more  clearly  document  the  work 
performed  and  tie  related  work  together  to  facilitate  a  review  by  an  independent  reviewer.  On 
August  30, 2012,  we  provided  these  workpapers  to  the  DoDIG.  We  respectfully  request  that  the 
DoDIG  consider  these  supplemental  workpapers  in  its  present  review  and  update  the  draft  report 
to  reflect  consideration  of  these  documents  Acuity  provided  to  further  clarify  our  audit  approach 
for  the  DoDIG. 

WP  References:  2400.50;  2500.03a.  1 ;  4000E.95;  4000E.97;  5000F.  1 5A.  1 ;  5000F.  1 5A.2 
ECD:  N/A. 

Auditing  Procedures  of  the  General  Property,  Plant,  and  Equipment 
Line  Item  Could  be  Improved 

DoDIG  Report:  Acuity  did  not  perform  procedures  to  determine  whether  the  PP&E  line  item  in 
the  DISA  FY20II  WCF  Financial  Statements  was  free  of  material  misstatements. 

Acuity  Response;  Acuity  performed  a  risk-based  and  standards-based  audit  approach  in 
accordance  with  AU§3 1 8,  AU§326,  and  AU§339,  as  is  more  fully  explained  in  the  following 
subsections. 

ECD:  N/A. 

Completeness  Testing  of  Property,  Plant,  and  Equipment 

DoDIG  Report:  Acuity  did  not  perform  adequate  testing  of  the  TSEAS  Network  PP&E  to  verify 
the  DISA  compliance  with  the  completeness  assertion. 

Acuity  Response:  AU§230,  Due  Professional  Care  in  the  Performance  of  Work,  requires  the 
auditor  to  plan  and  perform  the  audit  to  “obtain  sufficient  appropriate  audit  evidence  so  that  audit 
risk  [is]  limited  to  a  low  level  that  is,  [based  on  the  auditor’s  professional  judgment]  appropriate 
for  expressing  an  opinion  on  the  financial  statements.”  (AU§230.10)  Further,  as  noted  in  AU 
§230. 1 1 ,  the  auditor  uses  professional  judgment  “regarding  the  areas  to  be  tested  and  the  nature. 
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timing  and  extent  of  the  tests  to  be  performed.”  Acuity  assessed  risk  and  performed  risk-based 
and  standards-bascd  procedures  on  all  components  of  TSEAS  PP&E.  Specifically,  Acuity: 

•  Documented  our  inability  to  rely  on  DPAS  for  certain  classes  of  TSEAS  PP&E  and  noted 
that  we  would  apply  alternative  procedures  for  testing  completeness  with  respect  to 
TSEAS  network  PP&E.  The  nature  of  network  assets  and  lack  of  a  reliable  subsidiary 
ledger  impaired  our  ability  to  perform  routine  audit  procedures  such  as  floor-to-book 
testing  or  comparison  of  DPAS  records  to  accounts  payable  transactions.  Accordingly, 
we  designed  alternative  procedures  to  test  completeness  with  respect  to  TSEAS  network 
PP&E. 

•  Determined  appropriate  alternative  procedures.  1  laving  documented  that  this  area  of 
TSEAS  PP&E  relied  upon  a  pending  assets  process  in  conjunction  with  an  authorized 
capital  budget,  we  determined  an  appropriate  alternate  procedure  for  testing  the 
completeness  assertion  consisted  of  evaluating  the  effectiveness  of  controls  over  the 
budget  process;  reviewing  the  pending  assets  reconciliation  process;  testing,  on  a  sample 
basis,  the  values  recorded  in  the  pending  assets  accounts;  and  assessing  the  related 
internal  controls.  The  results  of  these  tests  supported  our  assessment  that  the  risk  of 
material  misstatement  was  low  with  respect  to  completeness  of  this  component  of  TSEAS 
PP&E. 

•  Tested  the  TSEAS  pending  assets  process  (including  certain  transactions  to  test  controls) 
as  well  as  the  capital  budget  process.  Our  tests  included  obtaining  and  reviewing 
supporting  documentation.  The  DoDIG  refers  to  notations  in  our  workpapers  regarding 
the  lack  of  a  certain  type  of  document  (SF  1 080)  to  support  certain  transactions.  In  those 
instances,  we  relied  upon  other  readily  available  documentation  (to  wit,  “CHOOSE 
reports”)  as  an  acceptable  alternative  to  the  SF  1080  (and  used  in  many  other  tests  of 
similar  transactions).  We  have  clarified  this  in  our  workpapers. 

As  noted  above  and  in  accordance  with  the  auditing  standards,  our  analysis  as  a  whole  and  the 
procedures  we  performed  with  respect  to  completeness  reduced  risk  to  an  acceptable  level,  which 
is  documented  in  our  workpapers. 

To  address  the  DoDIG’s  questions  and  clarify  points  apparently  misunderstood,  we  prepared 
supplemental  summary  workpapers  subsequent  to  the  audit  to  provide  clarity  with  respect  to  our 
conclusions  and  to  more  fully  reference  and  link  the  work  performed  throughout  the  audit  to 
facilitate  a  review  by  an  independent  reviewer.  The  supplemental  summary  workpapers  have 
been  updated  to  further  clarify  the  extent  of  our  procedures. 

On  August  30, 2012,  we  provided  the  supplemental  summary  workpapers  with  our  fully 
documented  conclusions  to  the  DoDIG,  but  it  does  not  appear  this  information  was  considered  in 
the  draft  report.  We  respectfully  request  that  the  DoDIG  consider  these  supplemental  workpapers 
in  its  present  review  and  update  the  draft  report  to  reflect  consideration  of  these  documents 
Acuity  provided  to  further  clarify  our  audit  approach  for  the  DoDIG. 

WP  References:  4000E.70;  4000E.95 

ECD:  N/A. 
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Acuity  did  not  state  that  the  DISA  Financial  Statement  Footnote 
Disclosures  were  Inadequate  in  their  Auditor’s  Report 

DoDIG  Report:  Acuity  did  not  state  in  its  auditor 's  report  that  the  DISA  financial  statement 
footnote  disclosures  were  inadequate  because  they  did  not  discuss  DISA  ‘s  Grouped  Asset  Cost 
Method  and  Grouped  Asset  Activation  and  Depreciation  Method. 

Acuity  Response:  The  financial  statements  accompanied  by  the  auditor’s  report  for  FY  201 1 
could  have  included  more  complete  disclosures  for  PP&E.  But  AU§561.06.a.  allows  for  revision 
of  only  the  most  recently  issued  financial  report,  while  AU§561.06.b.  states  that  “when  issuance 
of  financial  statements  accompanied  by  the  auditor’s  report  for  a  subsequent  period  is  imminent 
...  appropriate  disclosure  of  the  revision  can  be  made  ...  instead  of  reissuing  the  earlier 
statements.”  Acuity  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the 
note  disclosures  to  the  FY  2012  comparative  financial  statements  and  we  included  an 
explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15, 2012. 

Further,  as  of  August  30,  2012,  when  Acuity  discussed  these  concerns  with  the  DoDIG,  no  need 
existed  to  reissue  the  FY  201 1  audited  financial  report.  Specifically,  in  accordance  with 
AU§561 .06.b„  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent.  OMB 
Bulletin  No.  07-04  (as  amended  by  M-09-33),  Audit  Requirements  for  Federal  Financial 
Statements,  paragraph  5.6  states  that  “imminent  means  within  90  days  of  determining  the  effect 
of  the  misstatement(s)  on  the  previously  issued  financial  statements.”  As  stated  in  the  previous 
paragraph,  the  final  FY  2012  audited  financial  report  was  issued  November  15,  2012,  which  was 
within  90  days.  Accordingly,  reissuance  of  the  FY  201 1  audited  financial  report  is  neither 
necessary  nor  appropriate. 

WP  References:  4000E.97 

ECD:  Completed  November  15, 2012. 

DISA  did  not  disclose  Grouped  Asset  Cost  Method 

DoDIG  Report:  During  the  review  of  the  FY  2011  beginning  balances,  Acuity  issued  an  NOF 
discussing  the  DISA  grouped  asset  cost  method.  Acuity  stated  that  the  NOF  was  caused  from 
DISA  using  a  grouped  asset  costs  approach  rather  than  the  individual  cost  approach  to  identify 
and  value  assets.  Acuity  determined  that  the  effect  of  the  grouped  asset  cost  method  increased 
the  likelihood  that  a  material  misstatement  would  not  be  prevented  or  detected. 

Acuity  Response:  The  financial  statements  accompanied  by  the  auditor’s  report  for  FY  201 1 
could  have  included  more  complete  disclosures  for  PP&E.  But  AU§561 ,06.a.  allows  for  revision 
of  only  the  most  recently  issued  financial  report,  while  AU§561 ,06.b.  states  that  “when  issuance 
of  financial  statements  accompanied  by  the  auditor's  report  for  a  subsequent  period  is  imminent 
. . .  appropriate  disclosure  of  the  revision  can  be  made  . . .  instead  of  reissuing  the  earlier 
statements.”  Acuity  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the 
note  disclosures  to  the  FY  2012  comparative  financial  statements  and  we  included  an 
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explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15,  2012.  Accordingly, 
reissuance  of  the  FY  201 1  audited  financial  report  is  neither  necessary  nor  appropriate. 

DoDIG’s  many  references  to  DoD  7000. 14-R,  also  known  as  the  DoD  Financial  Management 
Regulation  (DoD  FMR),  are  not  relevant  as  a  standard  in  discussing  the  financial  statement  audit 
conducted  by  Acuity.  The  DoD  FMR  is  a  DoD  policy  and  is  neither  part  of  the  U.S.  GAAP 
hierarchy  nor  professional  auditing  standards  (e  g..  AICPA  Statements  on  Auditing  Standards; 
GAO-12-331G,  Government  Auditing  Standards)  that  an  1PA  firm  is  required  to  follow  in 
performing  a  financial  statement  audit  of  a  government  entity. 

WP  References:  4000E.97 

ECD:  Completed  November  15,  2012. 

DISA  did  not  disclose  Grouped  Asset  Activation  and  Depreciation  Method 
in  its  Financial  Statements 

DoDIG  Report ,  The  DISA  grouped  asset  activation  and  depreciation  method  deviated from  the 
standards  in  the  DoD  FMR.  DISA  did  not  disclose  any  of  the  issues  with  the  grouped  asset  cost 
activation  and  depreciation  method  in  its  financial  statements. 

Acuity  Response:  DoDIG’s  many  references  to  DoD  7000. 14-R,  also  known  as  the  DoD 
Financial  Management  Regulation  (DoD  FMR),  arc  not  relevant  as  a  standard  in  discussing  the 
financial  statement  audit  conducted  by  Acuity.  The  DoD  FMR  is  neither  part  of  the  U.S.  GAAP 
hierarchy  nor  professional  auditing  standards  (e  g.,  AICPA  Statements  on  Auditing  Standards; 
GAO- 1 2-33 1G,  Government  Auditing  Standards)  that  an  IPA  firm  is  required  to  follow  in 
performing  a  financial  statement  audit  of  a  government  entity. 

The  financial  statements  accompanied  by  the  auditor’s  report  for  FY  201 1  could  have  included 
more  complete  disclosures  for  PP&E.  But  AU§561 .06.a.  allows  for  revision  of  only  the  most 
recently  issued  financial  report,  while  AU§561.06.b.  states  that  “when  issuance  of  financial 
statements  accompanied  by  the  auditor’s  report  for  a  subsequent  period  is  imminent ... 
appropriate  disclosure  of  the  revision  can  be  made  . . .  instead  of  reissuing  the  earlier  statements.” 
Acuity  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the  note  disclosures 
to  the  FY  2012  comparative  financial  statements  and  we  included  an  explanatory  paragraph  in 
the  audit  report,  which  was  issued  November  15,  2012.  Accordingly,  reissuancc  of  the  FY  201 1 
audited  financial  report  is  neither  necessary  nor  appropriate. 

Additionally,  we  noted  an  inaccurate  statement  in  the  draft  report  with  respect  to  one  component 
of  TSEAS  PP&E.  Specifically,  the  DoDIG  indicates  that  “DISA  starts  asset  depreciation  in 
September  of  the  year  the  grouped  asset  is  activated.”  In  fact,  in  FY  201 1 ,  DISA  used  June  as 
the  activation  month.  This  is  clearly  stated  in  our  workpapers. 

WP  References:  4000E.97 

ECD:  Completed  November  15,2012. 
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Acuity’s  Audit  Report  Did  Not  State  that  the  DISA  Informative  Disclosures 
Were  Inadequate 

DoDIG  Report:  Acuity  did  not  comply  with  GAGAS  because  they  did  not  slate  in  the  auditor 's 
report  that  the  DISA  informative  disclosures  were  inadequate.  The  DISA  grouped  asset  cost 
method  and  the  activation  and  depreciation  method  are  not  in  accordance  with  accounting 
policy  for  Property,  Plant  and  Equipment  in  the  DoD  FMR. 

Acuity  Response:  Acuity  assessed  risk  and  performed  risk-based  and  standards-based 
procedures  on  PP&E  in  conducting  the  audit.  We  appropriately  documented  our  understanding 
and  our  work  followed  appropriate  standards,  including  GAGAS,  GAO/PC1K  FAM,  and  AICPA 
standards. 

DoDIG’s  many  references  to  DoD  7000. 14-R,  also  known  as  the  DoD  Financial  Management 
Regulation  (DoD  FMR),  are  not  relevant  as  a  standard  in  discussing  the  financial  statement  audit 
conducted  by  Acuity.  The  DoD  FMR  is  a  DoD  policy  and  is  neither  part  of  the  U.S.  GAAP 
hierarchy  nor  professional  auditing  standards  (e  g.,  AICPA  Statements  on  Auditing  Standards; 
GAO- 1 2-33 1G,  Government  Auditing  Standards)  that  an  IPA  firm  is  required  to  follow  in 
performing  a  financial  statement  audit  of  a  government  entity. 

The  financial  statements  accompanied  by  the  auditor’s  report  for  FY  201 1  could  have  included 
more  complete  disclosures  for  PP&E.  But  AU§561 .06.a.  allows  for  revision  of  only  the  most 
recently  issued  financial  report,  while  AU§561 ,06.b.  states  that  “when  issuance  of  financial 
statements  accompanied  by  the  auditor’s  report  for  a  subsequent  period  is  imminent ... 
appropriate  disclosure  of  the  revision  can  be  made  . . .  instead  of  reissuing  the  earlier  statements.” 
Acuity  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to  the  note  disclosures 
to  the  FY  2012  comparative  financial  statements  and  we  included  an  explanatory  paragraph  in 
the  audit  report,  which  was  issued  November  1 5, 2012. 

Further,  as  of  August  30,  2012,  when  Acuity  discussed  these  concerns  with  the  DoDIG,  no  need 
existed  to  reissue  the  FY  201 1  audited  financial  report.  Specifically,  in  accordance  with 
AU§561.06.b.,  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent.  OMB 
Bulletin  No.  07-04  (as  amended  by  M-09-33),  Audit  Requirements  for  Federal  Financial 
Statements ,  paragraph  5.6  states  that  “imminent  means  within  90  days  of  determining  the  effect 
of  the  misstatement(s)  on  the  previously  issued  financial  statements.”  As  stated  in  the  previous 
paragraph,  the  final  FY  2012  audited  financial  report  was  issued  November  15,  2012,  which  was 
within  90  days.  Accordingly,  reissuance  of  the  FY  201 1  audited  financial  report  is  neither 
necessary  nor  appropriate. 

Furthermore,  the  DoDIG  states  “Acuity  expressed  concerns  about  the  depreciation  methodology 
to  DISA”  in  FY  2012,  and  DISA  made  inquiries  to  the  FASAB  regarding  the  issue.  In  FY  2012, 
DISA  did  change  the  group  activation  date  to  September  (rather  than  June  in  FY  2011),  and 
Acuity  expressed  concerns  about  this  change.  The  DoDIG  also  states  the  matter  regarding  group 
activation  is  unresolved.  In  fact,  based  on  Acuity’s  concerns  about  using  September,  DISA 
continued  using  the  June  date  as  of  9/30/2012  and  declined  to  pursue  the  issue  with  FASAB. 
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Acuity  respectfully  disagrees  that  the  work  was  inadequate. 

ECD:  N/A. 

The  Contracting  Officer’s  Representative  Was  Unable  to  Complete 
Key  Duties  to  Provide  Oversight 

DoDIO  Report:  ...the  COR  provided  comments  on  documents  received  in  the  planning  phase, 
including  the  Plan  of  Actions  &  Milestones  [POAM],  In  addition,  the  COR  expressed  concerns 
that  Acuity  failed  to  provide  a  detailed  audit  plan.  The  COR  stated  that  Acuity  did  not  provide  a 
complete  audit  plan  until  February  2010,  four  months  after  the  beginning  of  the  audit. 

Acuity  Response:  While  this  finding  is  directed  to  the  D1SA  DoDIO,  Acuity  believes  the  01G 
report  is  inaccurate  based  upon  the  following  reasons: 

•  The  COR  reviewed  very  little  of  the  work  performed  and  provided  essentially  no 
feedback  beyond  the  POAM.  While  the  POAM  represented  a  contractual  requirement,  it 
was  not  representative  of  true  audit  planning  documentation. 

•  While  noting  the  COR  reviewed  the  POAM,  the  report  docs  not  mention  that  the  POAM 
was  delivered  in  advance  of  the  contractual  requirement  on  1 1/26/2010  and  we  duly 
responded  to  the  COR’s  comments  and  questions  on  12/6/2010.  The  audit  plan  was  not  a 
contract  deliverable,  but  was  provided  to  the  COR  within  two  months  of  the  request  (the 
fact  this  was  “four  months  after  the  beginning  of  the  audit”  is  irrelevant  [see  OIG  Report, 
page  15]). 

•  The  timing  and  delivery  of  the  audit  plan  was  consistent  with  the  timeline  presented  in 
the  draft  report  and  was  representative  of  typical  audit  planning  for  a  first-year  audit  of  a 
client  of  this  complexity  and  size. 

ECD:  N/A. 

Audit  Standards  Require  Reissuance  of  Auditor’s  Report 

DoDIO  Report:  A  U  Section  390,  Consideration  of  Omitted  Procedures,  stales  that  if  an  auditor 
concludes  an  omission  of  auditing  procedures  considered  necessary  at  the  time  of  the  audit 
impairs  his  present  ability  to  support  a  previously  expressed  opinion,  he  should  promptly  apply 
the  omitted  procedure  or  alternative  procedures  that  would  provide  a  satisfactory  basis  for  his 
opinion.  ...AU  Section  561,  Subsequent  Discovery  of  Facts,  Chapter  .05  states,  in  part,  that  when 
the  subsequently  discovered  information  is  found  to  be  both  reliable,  existed,  and  material  to  the 
financial  statements  at  the  date  of  the  auditor 's  report,  the  auditor  should  take  action  to  prevent 
further  reliance  on  the  report. 

Acuity  Response:  The  DoDIG’s  application  of  AU§56 1 ,  Subsequent  Discovery  of  Facts,  is 
incorrect.  The  correct  standard  to  apply  first  is  AU§390,  Consideration  of  Omitted  Procedures 
After  the  Report  Date.  After  review  of  AU  §390,  we  concluded  there  was  no  impairment  to  our 
ability  to  support  and  provide  a  satisfactory  basis  for  our  previously  expressed  opinion,  but  the 
issue  regarding  complete  note  disclosures  for  FBWT  and  PP&E  could  have  affected  the  FY  201 1 
report.  Acuity  applied  the  omitted  procedures  subsequent  to  the  audit  report  date  in  accordance 
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with  AU§390.  On  August  30, 2012,  this  information  was  provided  to  the  DoDIG,  but  evidently 
was  not  considered  in  developing  their  draft  report.  AU§390.06  states  the  auditor  should  be 
guided  by  the  provisions  of  AU§561. 05-09.  AU§561.06.a.  states  “...only  the  most  recently 
issued  audited  financial  statements  would  need  to  be  revised. ..”  AU§561 .06.b.  provides  further 
guidance:  “when  issuance  of  financial  statements  accompanied  by  the  auditor’s  report  for  a 
subsequent  period  is  imminent,  so  that  disclosure  is  not  delayed,  appropriate  disclosure  of  the 
revision  can  be  made  in  such  statements  instead  of  reissuing  the  earlier  statements  pursuant  to 
subparagraph  (a).”  Acuity  ensured  that  DISA  made  the  appropriate  corrections  and  revisions  to 
the  note  disclosures  to  the  FY  2012  comparative  financial  statements  and  we  included  an 
explanatory  paragraph  in  the  audit  report,  which  was  issued  November  15, 2012. 

Further,  as  of  August  30,  2012,  when  Acuity  discussed  these  concerns  with  the  DoDIG,  no  need 
existed  to  reissue  the  FY  201 1  audited  financial  report.  Specifically,  in  accordance  with 
AU§561.06.b.,  the  issuance  of  the  audited  financial  report  for  FY  2012  was  imminent.  OMB 
Bulletin  No.  07-04  (as  amended  by  M-09-33),  Audit  Requirements  for  Federal  Financial 
Statements,  paragraph  5.6  states  that  “imminent  means  within  90  days  of  determining  the  effect 
of  the  misstatementfs)  on  the  previously  issued  financial  statements.”  As  stated  in  the  previous 
paragraph,  the  final  FY  2012  audited  financial  report  was  issued  November  15,  2012,  which  was 
within  90  days.  Accordingly,  reissuance  of  the  FY  201 1  audited  financial  report  is  neither 
necessary  nor  appropriate. 

Acuity  respectfully  disagrees  the  audit  report  requires  reissuance. 

WP  References:  2500.03a.  1 
F.CD:  N/A. 

DISA  Contract  Required  Acuity  Compliance  with  Government  Auditing 
Standards 

DoDIG  Report:  The  DISA  audit  contract  required  that  Acuity  comply  with  standards  applicable 
to  financial  audits  contained  in  Government  Auditing  Standards  issued  by  the  Comptroller 
General  of  the  United  States.  Because  Acuity  did  not  have  sufficient  evidence  to  issue  an 
unqualified  opinion  on  the  FY  201 1  DISA  WCF  Financial  Statements,  their  work  did  not  comply 
with  Government  Auditing  Standards. 

Acuity  Response:  Acuity  designed  a  risk-based  audit  approach  in  accordance  with  audit 
standards,  including  AU§3 1 8,  Performing  Audit  Procedures  in  Response  to  Assessed  Risk ; 

AU§326,  Audit  Evidence ;  AU§339,  Audit  Documentation;  and  AU§508,  Reports  on  Audited 
Financial  Statements.  We  obtained  sufficient  and  appropriate  audit  evidence  to  support  our 
conclusions  and  provide  a  reasonable  basis  for  our  opinion.  Our  professional  judgment  as  to 
what  constituted  sufficient  appropriate  audit  evidence  was  influenced  by  factors  such  as  the 
significance  of  the  potential  misstatement  in  the  relevant  assertion  and  the  likelihood  of  its 
having  a  material  effect,  individually  or  aggregated  with  other  potential  misstatements,  on  the 
financial  statements.  Additionally,  we  considered:  the  effectiveness  of  management’s  responses 
and  controls  to  address  the  risks;  the  experience  we  gained  during  previous  audits;  our 
understanding  of  DISA  and  its  environment,  including  its  internal  controls;  the  source  and 
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reliability  of  available  information;  and  the  persuasiveness  of  the  audit  evidence.  We 
appropriately  documented  our  understanding  and  our  work  followed  appropriate  standards, 
including  GAGAS,  GAO/PCIE  FAM,  and  AICPA  standards.  Therefore,  Acuity  respectfully 
disagrees  that  Acuity  did  not  comply  with  Government  Auditing  Standards. 

WP  References: 

•  Audit  Plan:  1200.05;  1200.52;  1200.53 

•  Quality  Control  Checklists  with  AICPA  and  FAM  References:  1400.01;  1400.02; 
1400.03;  1400.04;  1400.05 

ECD:  N/A. 


Respectfully, 


Alan  B.  Spencer 
Managing  Partner 
Acuity  Consulting,  Inc. 


Date:  X/g//  1 
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